Windows Imaging Component CVE-2026-73013

The victim must cause Windows to render a specially crafted image through the WIC decoding pipeline. This is triggered by: explicitly opening an image file in any WIC-backed viewer (Photos app, Paint, legacy IE/Edge, Office), navigating to the image's parent folder in Windows Explorer with the Preview Pane enabled (hover sufficient in some configurations), or opening an Office document, web page, or email embedding the malicious image. No authentication to the target system, no elevated privileges, and no non-default configuration are required - WIC and Windows Explorer Preview Pane are enabled by default across all affected Windows editions. Exploitation is constrained by UI:R: a social engineering step (phishing email, malicious website, shared folder lure) must induce the target user to interact with the crafted file. On Windows Server Core installations, the desktop shell is absent, narrowing exploitation to application-layer WIC consumers such as IIS image-processing modules or document conversion services.

The CVSS 8.8 with AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a high-severity, network-reachable RCE gated only by a single user interaction. AC:L signals no special preconditions or race conditions are required beyond inducing the user to render a crafted image. The practical exploitation bar is further lowered by Windows Explorer's Preview Pane, which can render images without an explicit double-click, reducing UI:R to a hover or folder-navigation action. WIC's integration with Office and web-adjacent applications means delivery vectors include email attachments, malicious websites, and network shares. The broad affected range - 19 distinct Windows builds covering desktop and server SKUs from 2012 to 2026 - indicates a widely distributed attack surface. No CISA KEV listing and no confirmed POC at time of analysis provide some short-term risk reduction, but the straightforward trigger mechanism and ubiquitous target population make weaponization likely if unpatched. EPSS data was not provided; exploitation probability cannot be independently quantified. No conflict between the CVSS vector and the description is observed - network delivery of a malicious image file is consistent with AV:N/UI:R.

An attacker crafts a malicious TIFF or BMP image engineered to trigger a heap buffer overflow in the WIC decoder, then delivers it as an email attachment or hosts it on a phishing site. When the victim opens the file or navigates to the containing folder with Windows Explorer's Preview Pane enabled, WIC decodes the image in-process, the overflow corrupts heap metadata, and the attacker achieves arbitrary code execution in the context of the victim's user account. No public exploit code is confirmed at time of analysis, but the well-understood heap overflow primitive in a widely-studied codebase lowers the reverse-engineering barrier for a skilled attacker.