{"id":"CVE-2026-114166","kind":"vulnerability","aliases":["CVE-2026-114166"],"related":[],"title":"Windows Raw Image Extension: buffer over-read leaks memory to local users","description":"Buffer over-read in Windows Raw Image Extension allows an unauthorized attacker to disclose information locally.","summary":"A buffer over-read in the Windows Raw Image Extension lets an unauthorized local user read memory beyond the intended buffer. An attacker gets information disclosure only, not code execution, according to the advisory text.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Raw Image Extension","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:19:10+00:00","first_seen_at":"2026-11-10T19:24:44+00:00","triaged_at":"2026-11-10T20:01:59+00:00","updated_at":"2026-11-10T20:01:59+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:01:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Raw Image Extension: buffer over-read leaks memory to local users","impact":"low","summary":"A buffer over-read in the Windows Raw Image Extension lets an unauthorized local user read memory beyond the intended buffer. An attacker gets information disclosure only, not code execution, according to the advisory text.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker reads leaked memory contents from the process","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-114166 to confirm affected builds and the patched version.","how_to_check":"unknown","plain_action":"","product_name":"Windows Raw Image Extension","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running Windows with the Raw Image Extension installed, where a local user without rights could trigger the over-read. The sources do not say which Windows builds or default configurations are affected.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000668,"input_tokens":4491,"output_tokens":437,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114166':16A,19A '-2026':15A,18A 'accord':57B 'advisori':60B 'allow':71C 'attack':49B,74C 'beyond':44B 'buffer':5A,27B,47B,62C 'code':55B 'cve':14A,17A 'disclos':76C 'disclosur':52B 'execut':56B 'extens':4A,36B,70C 'extension':23A 'get':50B 'imag':3A,35B,69C 'image':22A 'inform':51B,77C 'infrastructur':24B 'intend':46B 'leak':9A 'let':37B 'local':12A,40B,78C 'memori':10A,43B 'over-read':6A,28B,63C 'raw':2A,21A,34B,68C 'read':8A,30B,42B,65C 'text':61B 'unauthor':39B,73C 'user':13A,41B 'window':1A,25B,33B,67C 'windows':20A","nicknames":[],"mitigations":[],"who_affected":"Systems running Windows with the Raw Image Extension installed, where a local user without rights could trigger the over-read. The sources do not say which Windows builds or default configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":["rawimageextension","windowsrawimageextension"],"ptokens":["extension","image","raw","windows"],"labels":["infrastructure","medium","vendor","windows"],"campaign_type":null,"search_a":"'-114166':16A,19A '-2026':15A,18A 'buffer':5A 'cve':14A,17A 'extens':4A 'extension':23A 'imag':3A 'image':22A 'leak':9A 'local':12A 'memori':10A 'over-read':6A 'raw':2A,21A 'read':8A 'user':13A 'window':1A 'windows':20A","search_b":"'accord':57B 'advisori':60B 'attack':49B 'beyond':44B 'buffer':27B,47B 'code':55B 'disclosur':52B 'execut':56B 'extens':36B 'get':50B 'imag':35B 'inform':51B 'infrastructur':24B 'intend':46B 'let':37B 'local':40B 'memori':43B 'over-read':28B 'raw':34B 'read':30B,42B 'text':61B 'unauthor':39B 'user':41B 'window':25B,33B","search_c":"'allow':71C 'attack':74C 'buffer':62C 'disclos':76C 'extens':70C 'imag':69C 'inform':77C 'local':78C 'over-read':63C 'raw':68C 'read':65C 'unauthor':73C 'window':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114166","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114166","severity":null,"published_at":"2026-11-10T19:19:10+00:00","modified_at":"2026-11-10T19:19:10+00:00","first_seen_at":"2026-11-10T19:24:44+00:00","fetched_at":"2026-11-10T19:24:44+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}