Windows Imaging Component EUVD-2026-99783

Exploitation requires local access to the target host with an existing low-privileged authenticated account (AV:L, PR:L), and the Windows Imaging Component must process attacker-supplied or attacker-influenced image data. No user interaction by a separate victim is required (UI:N). Limiting factors that reduce realistic risk: there is no remote/network vector, the attacker must already be authenticated on the machine, and impact is confined to disclosure of in-process memory (C:H, I:N, A:N) rather than code execution or privilege escalation. Affected scope is broad - essentially all supported Windows builds listed in the EUVD data below their patched versions - but each individual exploitation is local and single-system.

This is a low-to-moderate priority issue despite a CVSS of 5.5 (MEDIUM). Multiple signals align and point toward low real-world urgency: the CVSS vector is AV:L (local attack vector, not network), AC:L, PR:L (requires an existing authenticated local foothold), and impact is confidentiality-only (C:H/I:N/A:N) - an out-of-bounds read (CWE-125) leaking memory contents, with no integrity or availability impact. CISA's SSVC decision framework corroborates this: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no public exploit identified at time of analysis. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. None of the signals conflict: a local, authenticated, info-disclosure-only bug with no observed exploitation is a routine patch-cycle item, not an emergency. The main counterweight is prevalence - the affected product (Windows Imaging Component across essentially all supported Windows client and server builds) is ubiquitous, so while per-host risk is modest, the installed base is enormous and the patch should still be deployed in normal Patch Tuesday cadence.

A local attacker who already has a low-privileged authenticated session on a Windows host supplies or induces processing of a maliciously crafted image file through the Windows Imaging Component. The out-of-bounds read causes WIC to read beyond an allocated buffer, disclosing adjacent process memory (which may contain sensitive data) to the attacker. No public exploit code is identified at time of analysis, and the local-only, confidentiality-only nature limits impact to information disclosure rather than code execution.