CVE-2026-70296 – Windows Imaging Component Remote Code Execution Vulnerability

CVE-2026-70296 is a critical remote code execution vulnerability in the Windows Imaging Component caused by an out-of-bounds write. An attacker can craft a malicious RAW image and convince a user to navigate to a folder containing it. Windows can trigger the vulnerability while generating the image thumbnail or preview, meaning the file does not need to be opened. Successful exploitation can allow unauthorized code execution over a network.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no privileges or user interaction. Successful exploitation can have a high impact on confidentiality, integrity, and availability. A specially crafted RAW image can trigger the flaw through Windows thumbnail or preview processing.

EXPLOITS: Microsoft assesses exploitation as less likely. The vulnerability was not publicly disclosed and was not known to be exploited at publication. Exploit code maturity is listed as unproven, so the source does not confirm public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: The Windows Imaging Component contains an out-of-bounds write vulnerability, identified as CWE-787. An attacker can create a specially crafted RAW image file and cause a Windows system to process it when generating a thumbnail or preview. The victim does not need to manually open the image. The attack has low complexity, requires no attacker privileges, and requires no user interaction according to the CVSS metrics. Successful exploitation can result in remote code execution, with potentially high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and applicable architectures. Exploitation can occur when Windows generates a thumbnail or preview for a specially crafted RAW image.

BUSINESS IMPACT: Successful exploitation could allow an unauthorized attacker to execute code on affected systems, potentially compromising sensitive information, changing data, or disrupting system availability. The combination of remote code execution, low attack complexity, and no privilege requirement makes exposure particularly significant for organizations operating affected Windows systems.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, making deployment of the applicable security update the identified remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8. Its network attack vector, low attack complexity, no privilege requirement, no user-interaction requirement, and potential for remote code execution make timely patch deployment important. Although exploitation is assessed as less likely and no exploitation is reported, affected Windows systems should be prioritized for the applicable security update.