EUVD-2026-73849
GHSA-cpq5-3rf7-qrjm
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parsing trigger requires local user action (UI:R, AV:L); no attacker privileges needed (PR:N); full system compromise on success (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.
AnalysisAI
Heap-based buffer overflow in the Microsoft Windows Codecs Library HEIF Image Extension (versions 1.0.0.0 through 1.2.48.0) enables local code execution with full compromise of confidentiality, integrity, and availability on the affected system. Exploitation requires the victim to open or preview a maliciously crafted HEIF image file, making this vulnerability well-suited for file-based social engineering campaigns. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must have the HEIF Image Extension installed (it is an optional Microsoft Store codec, not present by default on all Windows installations - installations are more common on consumer machines and any system that has synced or opened Apple device photos). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score reflects a meaningful real-world risk profile: the local attack vector (AV:L) and required user interaction (UI:R) collectively prevent automated, unauthenticated network exploitation, but these constraints are consistent with a file-opening scenario - the attacker need not be present on the system and requires only that the victim opens a crafted image. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is updating the HEIF Image Extension to version 1.2.48.0 or later via the Microsoft Store (Settings → Microsoft Store → Library → Get Updates) or through Windows Update if the codec is system-managed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, use asset inventory or endpoint management tools to identify all systems running Microsoft Windows Codecs Library HEIF Image Extension versions 1.0.0.0 through 1.2.47.x, and issue guidance instructing users to avoid opening HEIF image files from untrusted sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today