Windows Imaging Component EUVD-2026-73700

User interaction is required: the targeted user must open, preview, or otherwise cause WIC to process the malicious image file (e.g., via Windows Explorer thumbnail generation, image viewer, browser rendering, or Office document embedding). No authentication is required on the attacker side - the malicious file can be delivered to any reachable user. The vulnerability is present in default configurations of all affected Windows builds; no non-default feature or configuration toggle must be enabled. Exploitation is limited by the UI:R requirement - fully automated server-side exploitation without user action is not indicated by the CVSS vector. Systems where users do not interact with externally-sourced image content (e.g., headless Server Core systems processing no image workloads) face substantially reduced practical exposure.

The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately characterizes this as a high-severity, network-delivered vulnerability requiring only user interaction - the threshold for exploitation is opening or previewing a malicious image. Attack complexity is low once a crafted image is constructed. No EPSS score was provided in the input; given the broad Windows deployment base and the WIC attack surface, real-world risk is elevated relative to many high-CVSS findings. No KEV listing and no public POC are identified, which slightly moderates immediate urgency for organizations with good patch cadence, but the combination of PR:N, AC:L, and ubiquitous deployment makes this a meaningful enterprise risk. The scope is unchanged (S:U), confirming exploitation is bounded to the victim process rather than escaping to the hypervisor or other tenants - typical for user-mode image parsers. The tag 'Buffer Overflow' is consistent with the integer overflow leading to a downstream buffer overread or overwrite.

An attacker crafts a malicious image file - for example, a TIFF or PNG with a manipulated dimension or buffer-length field that triggers the integer overflow in WIC's parser - and delivers it via email attachment, malicious website, or shared network path. When the victim opens the file or Windows Explorer generates a thumbnail, WIC processes the image, the integer wraparound produces an undersized heap buffer, and a subsequent memory copy overwrites adjacent heap memory with attacker-controlled data, enabling arbitrary code execution in the user's security context. No public POC has been identified at time of analysis, but the attack pattern is well-understood for image-format integer overflows.