Windows Imaging Component CVE-2026-73023

User interaction is required: the vulnerable WIC code path is triggered when Windows processes a crafted image file, which occurs during thumbnail rendering by Windows Explorer, image preview in Office or browsers, or explicit file open operations. Because Windows Shell invokes WIC automatically for supported image types during folder browsing, a victim does not need to 'open' the file intentionally - simply navigating to a folder or SMB share containing the malicious image may suffice. No authentication or special privileges are needed on the attacker side (PR:N). Limiting factors: exploitation requires delivering the malicious image to a path the victim's session will browse or preview; UI:R means fully passive server-side exploitation without any user session context is not possible. Windows Server Core installations have reduced attack surface if administrators do not browse image-containing shares interactively.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R scores 8.8, reflecting low complexity network exploitation with no privilege requirement and full C/I/A impact, offset only by the need for user interaction. In practice, UI:R for an image-processing flaw is a low bar: simply receiving an email with an embedded image, visiting a webpage, or browsing a network share containing a crafted file can trigger thumbnail generation without deliberate user action. EPSS data is not provided in the input, and the vulnerability is not in CISA KEV and has no known public exploit at time of analysis - reducing immediate priority relative to raw CVSS. However, the extremely wide affected surface (19 Windows OS/build combinations spanning end-of-support Server 2012 to current Windows 11 26H1) and the passive-interaction trigger profile make this a meaningful risk for unpatched environments. SSVC assessment: exploitation is technically feasible but no automation observed; technical impact is total; automatable is medium (email/web delivery lowers the bar). This is a genuine patching priority, not merely a paper score.

An attacker sends a phishing email containing a hyperlink to an attacker-controlled web server hosting a specially crafted image file. When the victim's browser or email client requests the image - or when Windows Explorer auto-generates a thumbnail upon folder access - WIC processes the malformed image, triggering the heap overflow and executing attacker-supplied shellcode in the context of the victim's user session. No public exploit code is known at time of analysis, but the UI:R bar is effectively passive for thumbnail-triggering scenarios.