CVE-2026-77495 – Windows Imaging Component Remote Code Execution Vulnerability

CVE-2026-77495 is a heap-based buffer overflow in Windows Imaging Component that can allow an unauthorized attacker to execute code over a network. Exploitation requires a user to open a specially crafted file. The vulnerability requires no privileges, has low attack complexity, and can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker can create a specially crafted file and convince a user on an affected Windows system to open it. Successful exploitation can result in remote code execution, creating the potential for unauthorized actions and significant compromise of the affected system.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is rated Unproven, and exploitation is assessed as Less Likely. No public exploit, zero-day exploitation, or proof-of-concept exploit code is confirmed.

TECHNICAL SUMMARY: The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Windows Imaging Component. It has a network attack vector, low attack complexity, requires no privileges, and requires user interaction. An attacker must get a user to open a specially crafted file to trigger the vulnerability. Successful exploitation can execute code on the affected system, with high potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. Supported architectures vary by release and include 32-bit, x64, and ARM64 systems. Exploitation requires the target user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to run on vulnerable Windows endpoints or servers. Because confidentiality, integrity, and availability impacts are all rated High, compromise could expose sensitive information, enable unauthorized modification of data or systems, and disrupt affected services. A malicious file that reaches a user therefore has the potential to become a serious system compromise.

WORKAROUND: No workaround or mitigation is listed. An official fix is available, so affected systems should be updated through the applicable security update.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can lead to remote code execution. Although it is not reported as exploited and exploitation is assessed as Less Likely, the combination of low attack complexity, no privilege requirement, and high confidentiality, integrity, and availability impact makes timely deployment important.