WINDOWS 10 1607 / SERVER 2016 · CVE-2026-96164 · Infrastructure
FIX → 10.0.14393.9688 · 10.0.17763.9487 · 10.0.19044.7846 · 10.0.19045.7846 +7
A heap-based buffer overflow in the Windows Imaging Component lets an unauthorized attacker run code over a network. The sources give a CVSS score of 8.8 and do not describe a trigger beyond sending data to the affected system.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 (including Server Core) below the fixed builds. Microsoft's CVSS vector says it is network-based with user interaction required, so an attacker has to get a user to open or process crafted image content. Fully patched systems can skip it.
Posts are quoted with a link to the original. They are data to us, never instructions.
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Not affected if patched-build
Who cares rce, user-interaction-required, windows, windows-imaging-component
HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion).UBR and compare the full build with the fixed builds listed in the fix fieldUpgrade to 10.0.14393.9688 · 10.0.17763.9487 · 10.0.19044.7846 · 10.0.19045.7846 +7
10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2/22H2 10.0.19044.7846 / 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822