CVE-2026-73013 – Windows Imaging Component Remote Code Execution Vulnerability

A heap-based buffer overflow in the Windows Imaging Component could allow an unauthorized attacker to execute code on an affected Windows system. Exploitation occurs over a network but requires a user to open a specially crafted file. No privileges are required, attack complexity is low, and successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker can create a specially crafted file and convince a user on an affected Windows system to open it. This can trigger the heap-based buffer overflow and lead to remote code execution. The vulnerability has a network attack vector, low attack complexity, requires no privileges, and does require user interaction.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-73013 is a heap-based buffer overflow (CWE-122) in the Windows Imaging Component. An unauthorized attacker can supply a specially crafted file that, when opened by a user, triggers the vulnerability and can result in remote code execution. The attack can originate over a network, requires low attack complexity and no prior privileges, but depends on user interaction. Successful exploitation can significantly affect confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations. Supported architectures vary by version and include 32-bit, x64, and ARM64 systems. Exploitation requires a user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to run on an affected system, creating serious risks to sensitive information, system integrity, and service availability. In an organization, a compromised endpoint or server could disrupt business operations or expose information accessible through the affected system.

WORKAROUND: No workaround or mitigation is specified. An official fix is identified as the remediation, so affected systems should receive the applicable security update.

URGENCY: This vulnerability carries a Critical severity rating and a CVSS base score of 8.8. Its low attack complexity, network attack vector, lack of privilege requirements, and potential for remote code execution make prompt deployment important. Although exploitation requires user interaction and current exploitation is assessed as Less Likely, successful exploitation can have high confidentiality, integrity, and availability impact.