CVE-2026-70351 – Microsoft WebP Image Extension Remote Code Execution Vulnerability
CVSS 8.8
IMPORTANT
Critical - Same Day Deployment
“A malicious WebP file could turn a simple file-open action into remote code execution, putting systems and data at serious risk.”
An integer overflow or wraparound in the Microsoft WebP Image Extension can lead to a heap-based buffer overflow and remote code execution. An unauthorized attacker can target the vulnerability over a network, but exploitation requires a user to open a specially crafted file. No privileges are required. Successful exploitation can have a high impact on confidentiality, integrity, and availability.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- CWE Classification
- CWE-122
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.