EUVD-2026-56301
GHSA-j5xq-mhhm-fmpp
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open trigger (AV:L), no prior privilege required (PR:N), user must open crafted image (UI:R), full impact on user context with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.
AnalysisAI
Heap-based buffer overflow in Windows Imaging Component (WIC), Microsoft's built-in image processing framework, enables local code execution across virtually every supported Windows client and server release from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. The flaw is triggered when a user opens or previews a specially crafted image file, requiring no prior authentication or elevated privileges, and yields full confidentiality, integrity, and availability impact on the compromised system. Vendor-released patches are available via Microsoft's July 2026 update cycle; no public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
Windows Imaging Component (WIC) is a core Windows subsystem that provides a pluggable pipeline for image codec registration, pixel format conversion, and metadata extraction. It is invoked transparently by Windows Explorer thumbnail generation, Office applications, Internet Explorer/Edge legacy, and countless third-party applications whenever images are decoded or rendered. The root cause is CWE-122 (Heap-based Buffer Overflow): during image parsing, a length or offset value derived from the crafted file is not properly validated before being used to write into a heap-allocated buffer, allowing the write to extend beyond the buffer's allocated bounds. Heap-based overflows in image parsers are a well-studied exploit class; attackers can prime the heap layout to achieve controlled overwrites of adjacent allocations such as function pointers or allocator metadata, converting memory corruption into arbitrary code execution. The CVSS vector AV:L/AC:L/PR:N/UI:R confirms the attack is triggered locally with low complexity and no privilege prerequisite, consistent with a file-open or thumbnail-render trigger via WIC.
RemediationAI
The primary remediation is to apply the vendor-released patches distributed through Windows Update, WSUS, or Microsoft Update Catalog for each affected build, targeting the fixed versions confirmed by EUVD-2026-56301 - for example, Windows Server 2025 to build 10.0.26100.33296, Windows Server 2019 to 10.0.17763.9115, Windows 11 23H2 to 10.0.22631.7517, and Windows 10 22H2 to 10.0.19045.7663. Full per-version patch details and download links are available at the Microsoft MSRC advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54984. Where immediate patching is not feasible, a partial compensating control is to restrict users from opening image files sourced from untrusted locations - for example, enforcing email attachment blocking policies for common image formats (TIFF, BMP, ICO, WMF, EMF) at the mail gateway; note this degrades legitimate workflow and does not protect against images delivered via web browsing. Disabling thumbnail preview in Windows Explorer (via Folder Options → Always show icons, never thumbnails) reduces automatic WIC invocation on file browse, but does not prevent exploitation when users manually open files. Prioritize patching internet-facing servers that process user-supplied image uploads, as these represent a higher-value and more accessible attack path despite the local vector.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today