---
id: "CVE-2026-114166"
page: "https://infrastack.ai/live/CVE-2026-114166"
kind: "vulnerability"
aliases: ["CVE-2026-114166"]
title: "Windows Raw Image Extension: buffer over-read leaks memory to local users"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Raw Image Extension", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:19:10+00:00"
first_seen_at: "2026-11-10T19:24:44+00:00"
updated_at: "2026-11-10T20:01:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114166", "first_seen_at": "2026-11-10T19:24:44+00:00"}]
exploit_sources: []
---

# Windows Raw Image Extension: buffer over-read leaks memory to local users

Link for people: https://infrastack.ai/live/CVE-2026-114166 (this .md is for agents)

A buffer over-read in the Windows Raw Image Extension lets an unauthorized local user read memory beyond the intended buffer. An attacker gets information disclosure only, not code execution, according to the advisory text.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Raw Image Extension affected range not listed fixed no fixed version listed

## Timeline

- 2026-11-10T19:24:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114166

## From the sources

Buffer over-read in Windows Raw Image Extension allows an unauthorized attacker to disclose information locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_