Windows Imaging Component CVE-2026-77495

User interaction is required: a victim must open, preview, or browse to a directory containing a crafted image file, causing Windows Imaging Component to parse the malicious content. No authentication, special configuration, or elevated privileges are required from the attacker - a standard unprivileged network delivery mechanism (email attachment, web download, SMB share with malicious image) is sufficient. The automatic thumbnail-generation behavior of Windows Explorer means that merely browsing a folder containing the crafted image in Explorer may satisfy the UI:R condition. Exploitation is limited by: (1) the requirement for some form of user interaction with the file, (2) scope-unchanged containing impact to the victim's own process/session rather than the broader system at the kernel level, and (3) standard ASLR/heap mitigations present in modern Windows builds, which increase exploit development complexity without eliminating feasibility.

The CVSS 8.8 score and AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:H vector accurately reflect a high-severity, widely exploitable condition - the primary limiting factor is UI:R (user must open or preview a crafted image), which reduces automatable mass exploitation compared to a wormable PR:N/UI:N flaw. EPSS data was not provided; without it, exploitation likelihood must be inferred from signal strength: no KEV listing and no disclosed POC code suggest active exploitation has not yet been observed at scale. However, the low attack complexity, zero prerequisite privileges, and enormous installed base of affected Windows versions represent exactly the profile threat actors routinely weaponize post-patch via patch-diffing. The breadth of affected versions - spanning Windows Server 2012 through Server 2025 - means organizations with extended-support or unpatched legacy systems face elevated risk. The scope-unchanged (S:U) metric implies exploitation is contained to the victim process context, though heap overflow primitives can frequently be leveraged for full process compromise leading to lateral movement. Real-world priority is HIGH for organizations with end-user workstations and unpatched servers; the UI:R constraint is reliably overcome via phishing or malicious web content.

An attacker sends a phishing email embedding or attaching a crafted image file (e.g., a malformed TIFF or HEIF) to a target user; when the victim previews or opens the attachment, Windows Imaging Component processes the malicious image, triggering the heap overflow and executing attacker-supplied shellcode in the context of the victim's user session. Because Windows Explorer generates thumbnails automatically when a folder is browsed, simply navigating to a directory containing the malicious image may be sufficient to trigger exploitation without an explicit file open. No public POC has been identified at time of analysis.