CVE-2026-73023 – Windows Imaging Component Remote Code Execution Vulnerability

CVE-2026-73023 is a critical heap-based buffer overflow vulnerability in the Windows Imaging Component. An unauthorized attacker can target the vulnerability over a network by convincing a user to open a specially crafted file. Successful exploitation can result in remote code execution. Exploitation requires no attacker privileges but does require user interaction.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no privileges. A user must open a specially crafted file supplied by an attacker to trigger the vulnerability. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and the exploitability assessment is Exploitation Less Likely. The existence of public exploit code, zero-day exploitation, or proof-of-concept code cannot be confirmed.

TECHNICAL SUMMARY: CVE-2026-73023 is caused by a heap-based buffer overflow (CWE-122) in the Windows Imaging Component. The attack can originate over a network and has low attack complexity. An attacker requires no privileges but must persuade a user to open a specially crafted file. Processing that file can trigger the buffer overflow and allow unauthorized remote code execution. Successful exploitation can significantly affect the confidentiality, integrity, and availability of the affected system.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations. Architectures vary by release and include 32-bit, x64, and ARM64 systems. Exploitation requires a user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow an attacker to execute code on an affected Windows system, creating serious risks to sensitive information, system integrity, and service availability. For organizations, compromise of vulnerable endpoints or servers could disrupt operations and expose systems or information to unauthorized activity.

WORKAROUND: No workaround or mitigation is listed. An official fix is identified, making deployment of the applicable security update the available remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can result in remote code execution with high confidentiality, integrity, and availability impacts. Although exploitation is assessed as less likely and no exploitation is reported, affected Windows systems should be prioritized for deployment of the official fix because opening a maliciously crafted file can trigger the vulnerability.