{"id":"CVE-2026-96164","kind":"vulnerability","aliases":["CVE-2026-96164"],"related":[],"title":"Windows Imaging Component heap overflow allows remote code execution when a user opens crafted content","description":"Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in the Windows Imaging Component lets an unauthorized attacker run code over a network. The sources give a CVSS score of 8.8 and do not describe a trigger beyond sending data to the affected system.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","rce","user-interaction-required","windows","windows-imaging-component"],"not_affected_if":["patched-build"],"how_to_check":"Run winver or PowerShell [System.Environment]::OSVersion.Version / (Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').UBR and compare the full build with the fixed builds listed in the fix field. A build below the fixed one for your Windows version is exposed.","fix":"Install the November 2026 Windows cumulative update that brings the OS build to at least: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2/22H2 10.0.19044.7846 / 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. KB numbers not confirmed; see MSRC entry.","status":"open","published_at":"2026-11-10T19:22:13+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","triaged_at":"2026-11-10T19:27:36+00:00","updated_at":"2026-11-10T19:42:39+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:27:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Imaging Component: heap overflow lets a network attacker run code","impact":"high","summary":"A heap-based buffer overflow in the Windows Imaging Component lets an unauthorized attacker run code over a network. The sources give a CVSS score of 8.8 and do not describe a trigger beyond sending data to the affected system.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-imaging-component"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the machine over the network","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-96164 for affected Windows builds, fixed KB or build numbers, and whether user interaction is needed.","how_to_check":"- unknown","plain_action":"Install the latest Windows security update on your PC, which the sources do not name specifically, through Windows Update.","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running Windows that process images through the Windows Imaging Component. The sources do not say which Windows versions or which image-handling paths are exposed, so the exact scope is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000684,"input_tokens":4494,"output_tokens":469,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-96164 for affected Windows builds, fixed KB or build numbers, and whether user interaction is needed.","search":"'-2026':17A,20A '-96164':18A,21A '10':23A,28A,33A,36A '11':39A,42A,45A,48A,51A '1607':24A '1809':29A '2016':26A '2019':31A '2022':55A '2025':58A '21h2':34A '22h2':37A '23h2':40A '24h2':43A '25h2':46A '26h1':49A '26h2':52A '8.8':97B 'affect':109B 'allow':6A,120C 'attack':84B,123C 'base':73B,113C 'beyond':104B 'buffer':74B,114C 'code':8A,86B,126C 'compon':3A,69B,80B,119C 'content':15A 'craft':14A 'cve':16A,19A 'cvss':94B 'data':106B 'describ':101B 'execut':9A,125C 'give':92B 'heap':4A,72B,112C 'heap-bas':71B,111C 'imag':2A,68B,79B,118C 'infrastructur':59B 'interact':63B 'let':81B 'network':89B,129C 'open':13A 'overflow':5A,75B,115C 'rce':60B 'remot':7A 'requir':64B 'run':85B 'score':95B 'send':105B 'server':25A,30A,54A,57A 'sourc':91B 'system':110B 'trigger':103B 'unauthor':83B,122C 'user':12A,62B 'user-interaction-requir':61B 'window':1A,65B,67B,78B,117C 'windows':22A,27A,32A,35A,38A,41A,44A,47A,50A,53A,56A 'windows-imaging-compon':66B","nicknames":[],"mitigations":[],"who_affected":"Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 (including Server Core) below the fixed builds. Microsoft's CVSS vector says it is network-based with user interaction required, so an attacker has to get a user to open or process crafted image content. Fully patched systems can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Install the latest Windows updates: Settings > Windows Update > Check for updates.","pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","rce","userinteractionrequired","windows","windowsimagingcomponent"],"campaign_type":null,"search_a":"'-2026':17A,20A '-96164':18A,21A '10':23A,28A,33A,36A '11':39A,42A,45A,48A,51A '1607':24A '1809':29A '2016':26A '2019':31A '2022':55A '2025':58A '21h2':34A '22h2':37A '23h2':40A '24h2':43A '25h2':46A '26h1':49A '26h2':52A 'allow':6A 'code':8A 'compon':3A 'content':15A 'craft':14A 'cve':16A,19A 'execut':9A 'heap':4A 'imag':2A 'open':13A 'overflow':5A 'remot':7A 'server':25A,30A,54A,57A 'user':12A 'window':1A 'windows':22A,27A,32A,35A,38A,41A,44A,47A,50A,53A,56A","search_b":"'8.8':97B 'affect':109B 'attack':84B 'base':73B 'beyond':104B 'buffer':74B 'code':86B 'compon':69B,80B 'cvss':94B 'data':106B 'describ':101B 'give':92B 'heap':72B 'heap-bas':71B 'imag':68B,79B 'infrastructur':59B 'interact':63B 'let':81B 'network':89B 'overflow':75B 'rce':60B 'requir':64B 'run':85B 'score':95B 'send':105B 'sourc':91B 'system':110B 'trigger':103B 'unauthor':83B 'user':62B 'user-interaction-requir':61B 'window':65B,67B,78B 'windows-imaging-compon':66B","search_c":"'allow':120C 'attack':123C 'base':113C 'buffer':114C 'code':126C 'compon':119C 'execut':125C 'heap':112C 'heap-bas':111C 'imag':118C 'network':129C 'overflow':115C 'unauthor':122C 'window':117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96164","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96164","severity":null,"published_at":"2026-11-10T19:22:13+00:00","modified_at":"2026-11-10T19:22:13+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","fetched_at":"2026-11-10T19:25:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96164:2538","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96164","severity":null,"published_at":"2026-11-10T19:42:39+00:00","modified_at":"2026-11-10T19:42:39+00:00","first_seen_at":"2026-11-10T19:42:39+00:00","fetched_at":"2026-11-10T19:42:39+00:00","note":"Read NVD record carrying Microsoft CNA data (affected builds, CVSS vector UI:R). MSRC page is JS-only and returned empty, so KB numbers unknown and nothing marked verified. No exploitation or PoC seen.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-96164"]}],"documents":[{"id":117660,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96164","title":"NVD CVE-2026-96164 (Microsoft CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}