Raw Image Extension CVE-2026-96202

Exploitation requires that the optional Windows Raw Image Extension (Microsoft Store add-on, versions 2.1.0.0 through earlier than 2.4.36.0) be installed, and that a user open or preview an attacker-crafted RAW image file in an application that invokes the extension (e.g., Windows Photos or Explorer preview) - this user interaction (UI:R) is the primary limiting factor. There is no authentication requirement (PR:N) and attack complexity is low (AC:L), but the attack is not automatable (SSVC: Automatable 'no') precisely because a human must open the malicious file. Systems without the Raw Image Extension installed are not affected.

This is a genuinely serious but not emergency-level vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, unauthenticated, low-complexity flaw with total compromise of confidentiality, integrity and availability - the only gating factor being required user interaction (UI:R), namely opening or previewing a malicious RAW image. CISA's SSVC framework, however, tempers this: Exploitation is rated 'none' (no observed or public exploitation) and Automatable is 'no' (the user-interaction requirement prevents worm-like mass exploitation), while Technical Impact is 'total,' consistent with the C:H/I:H/A:H and CWE-122 heap overflow enabling code execution. There is no KEV listing and no EPSS score in the provided data, so there is NO signal of active or imminent widespread exploitation - current status is 'no public exploit identified at time of analysis.' The signals are therefore consistent rather than conflicting: high technical severity, but low real-world exploitation pressure today, mitigated further by the user-interaction gate and the fact that the affected component is an optional add-on rather than a core OS service. Priority should be driven by whether the Raw Image Extension is actually deployed in the environment (photographers, media/design workstations) rather than by the 8.8 score alone. MISSING DATA: no EPSS probability and no explicit POC indicator were provided, so exploitation likelihood is inferred solely from SSVC 'Exploitation: none.'

An attacker crafts a malicious RAW camera image file (e.g., delivered via email attachment, chat, or a website download) and entices a user with the Windows Raw Image Extension installed to open or preview it in a Windows app such as Photos or File Explorer. The malformed image triggers a heap-based buffer overflow in the extension's parsing code, allowing the attacker to execute arbitrary code in the context of the user. No public exploit is identified at time of analysis, and because UI:R is required, exploitation depends on the victim opening the file.