Raw Image Extension CVE-2026-96943

Requires the optional Windows Raw Image Extension codec (versions 2.1.0.0 up to but not including 2.4.36.0) to be installed on the target - it is not present on default Windows installations. Exploitation further requires user interaction (CVSS UI:R): the victim must open, preview, or let the shell generate a thumbnail for an attacker-supplied malformed RAW image file. No authentication is required (PR:N) and the malicious file can be delivered remotely (AV:N) via email, web download, or network share. The dependence on both the optional codec being installed and victim interaction with the crafted file are the primary factors limiting real-world exploitation.

This is a credible, patch-worthy priority but not a drop-everything emergency based on the signals available. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes an unauthenticated, low-complexity remote code execution triggered by user interaction - consistent with a malicious RAW image file delivered via email, web, or file share and opened/previewed by the victim. CWE-122 (heap-based buffer overflow) stemming from an integer overflow in the Windows Raw Image Extension codec aligns well with the 'execute code over a network' description. However, several enriching signals are MISSING: no EPSS score was provided, so exploitation probability cannot be quantified; there is no CISA KEV listing and no POC indicator, so exploitation status is 'no public exploit identified at time of analysis'; and no SSVC decision data was supplied. The UI:R requirement materially lowers real-world risk versus a zero-click flaw - successful attack depends on social engineering the victim into opening a crafted image. The product is also an OPTIONAL Windows component, not installed by default on every host, further narrowing the realistic attack surface. Net: treat as High-priority patching (Microsoft patch is available) given RCE potential, but absent KEV/POC/EPSS data there is no evidence of active or imminent widespread exploitation.

An attacker crafts a malformed RAW camera image file that triggers an integer overflow leading to a heap buffer overflow in the Windows Raw Image Extension codec, then delivers it via email attachment, malicious website, or shared folder. When the victim opens or previews the file on a system with the vulnerable extension installed, the overflow corrupts heap memory and allows arbitrary code execution in the user's context. No public exploit code was identified in the provided intelligence, and exploitation requires the user to interact with the malicious file (UI:R).