CVE-2026-70351 – Microsoft WebP Image Extension Remote Code Execution Vulnerability

An integer overflow or wraparound in the Microsoft WebP Image Extension can lead to a heap-based buffer overflow and remote code execution. An unauthorized attacker can target the vulnerability over a network, but exploitation requires a user to open a specially crafted file. No privileges are required. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker could craft a malicious file designed to trigger the memory corruption vulnerability. If a user opens that file, the attacker could execute code in the affected context. The attack complexity is low, requires no privileges, and can result in significant compromise of the affected system.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Unlikely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-70351 is a remote code execution vulnerability in Microsoft WebP Image Extension involving integer overflow or wraparound and a heap-based buffer overflow. A specially crafted file can trigger the flaw when opened by a user. The attack vector is network-based, attack complexity is low, and no attacker privileges are required. Successful exploitation could execute code and cause high confidentiality, integrity, and availability impact. An official fix is identified.

EXPLOITABILITY: Microsoft WebP Image Extension is affected. Specific affected version or build numbers cannot be confirmed. Exploitation requires a user to open a specially crafted attacker-controlled file.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution and lead to loss of sensitive information, unauthorized system changes, or disruption of affected systems. For organizations, a malicious file reaching a user could become an entry point for a serious endpoint compromise.

WORKAROUND: No workaround or mitigation is identified. An official fix is identified, but the fixed build cannot be confirmed.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can lead to remote code execution with no attacker privileges required. Although exploitation is currently assessed as Unlikely and user interaction is required, the potential impact to confidentiality, integrity, and availability makes timely deployment important.