Windows Image Acquisition EUVD-2026-99913

Exploitation requires the victim to open or process an attacker-crafted image through the Windows Image Acquisition (WIA) component (UI:R - user interaction is mandatory), so this is not a zero-click flaw. No authentication is required of the attacker (PR:N) and no special non-default configuration is indicated in the description. The user-interaction requirement is the primary limiting factor and is reflected in CISA's SSVC 'Automatable: no' rating, meaning reliable mass/automated exploitation is unlikely; realistic risk centers on social-engineering delivery (malicious attachments/downloads) to a user on an unpatched Windows 11 (24H2/25H2/26H1/26H2) or Windows Server 2025 build below the fixed version.

This is a genuinely high-priority patch-now issue, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw yielding full confidentiality/integrity/availability impact (code execution), with the only brake being required user interaction (UI:R). CISA's SSVC framework tempers the urgency: Exploitation is rated 'none' (no observed or public exploitation) and Automatable is 'no' (the UI:R requirement prevents reliable worming/mass-automation), while Technical Impact is 'total' - consistent with heap-overflow code execution. These signals are internally coherent: high raw severity driven by impact, but the real-world exploitation path depends on luring a user to process a malicious image, which lowers scalability. No EPSS score, KEV listing, or POC was provided in the input; absence of these is not evidence of safety but does mean there is currently no confirmed active exploitation or public exploit to drive opportunistic attacks. Net assessment: a serious, broadly-applicable Windows code-execution bug worth prioritizing in normal patch cycles, but not showing signs of in-the-wild exploitation at time of analysis.

An attacker crafts a malicious image file and delivers it to a victim (via email attachment, web download, or a networked scanner/camera path handled by Windows Image Acquisition); when the user opens or lets Windows process the image, the heap-based buffer overflow triggers and executes attacker-controlled code in the user's context. The attack is network-deliverable and low-complexity but requires that user interaction (UI:R) to succeed. No public exploit code was identified in the provided data.