EUVD-2026-73727
GHSA-j9hh-7mj6-f56v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-delivered malformed image with no privileges, but WIC decoding realistically needs the victim to receive/preview the file, so UI:R; memory-corruption RCE yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds write in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in the Windows Imaging Component (WIC) affects all supported Windows client and server releases (Windows 10, 11 through 25H2, and Windows Server 2012 through 2025). An out-of-bounds write while decoding attacker-controlled image data lets a remote, unauthenticated attacker corrupt memory and execute arbitrary code in the context of the process that parses the image. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target system to decode an attacker-supplied image through the Windows Imaging Component - delivered via email attachment, message, web content, or a file dropped where Explorer generates a thumbnail/preview. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are strong on paper: CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N), CWE-787 memory corruption, and a vendor-confirmed patch across every current Windows/Server build. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update for CVE-2026-70296 to the appropriate build for each SKU (patch available per vendor advisory) - for example Windows 11 24H2/25H2 to 10.0.26100.9445/10.0.26200.9445, Windows 10 22H2 to 10.0.19045.7725, Windows Server 2025 to 10.0.26100.33438, and Server 2022 to 10.0.20348.5622; consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70296 for the exact KB per version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, document all systems running Windows 10, Windows 11 (through version 25H2), or Windows Server 2012-2025, and query email gateways and web filtering systems for suspicious image-file transfers that may indicate exploitation activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today