Microsoft has disclosed a CVSS 9.8 out-of-bounds write flaw in the Windows Imaging Component that lets an unauthenticated attacker execute code over a network, affecting nearly every supported Windows client and server release.
What Is It
CVE-2026-70296 is an out-of-bounds write in the Windows Imaging Component (WIC). Per Microsoft's description, the flaw "allows an unauthorized attacker to execute code over a network." It carries a CVSS 3.1 base score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low complexity, no privileges, and no user interaction, with total loss of confidentiality, integrity, and availability.
The CVE was published on 2026-09-08 by Microsoft ([email protected]) and currently sits in NVD as "Awaiting Analysis."
Why It Matters
The combination of AV:N/PR:N/UI:N is the worst-case profile: no credentials, no clicks, no local foothold required. An out-of-bounds write in an image-parsing component is a classic memory-corruption primitive, and WIC is a broadly reachable codec surface across Windows.
The supplied source material contains no evidence of active exploitation, no public proof-of-concept, and no attributed threat activity. Prioritize on severity and exposure, not on confirmed in-the-wild use.
What's Vulnerable
Microsoft lists fixed builds across the full supported estate:
| Product | Fixed in |
|---|---|
| Windows 10 1607 / Server 2016 | 10.0.14393.9512 |
| Windows 10 1809 / Server 2019 | 10.0.17763.9245 |
| Windows 10 21H2 | 10.0.19044.7725 |
| Windows 10 22H2 | 10.0.19045.7725 |
| Windows 11 23H2 (x64, ARM64) | 10.0.22631.7582 |
| Windows 11 24H2 / 25H2 | 10.0.26100.9445 / 10.0.26200.9445 |
| Windows 11 26H1 | 10.0.28000.2954 |
| Windows Server 2012 (+ Core) | 6.2.9200.26349 |
| Windows Server 2012 R2 (+ Core) | 6.3.9600.23397 |
| Windows Server 2022 | 10.0.20348.5622 |
| Windows Server 2025 (+ Core) | Affected — confirm build in MSRC (see caveat below) |
One caveat on the table: Windows Server 2025 and Windows 11 24H2 share the same 26100 base build and are serviced from the same branch, so they would normally receive the same revision, but the revision reported for Server 2025 in the published data is inconsistent with the 24H2 value (26100.9445), and the discrepancy is unresolved. The Server 2025 revision is therefore omitted here as unverified; confirm the exact fixed build in the MSRC update guide before using it as a patch-compliance baseline.
Affected platforms span 32-bit, x64, and ARM64 systems. Server Core installations are explicitly in scope.
Patch Status
Patched builds are published for all listed products. Apply the vendor updates through normal Patch Tuesday channels, prioritizing internet-reachable and image-processing hosts. Consult the MSRC update guide for the specific KB mapped to each build; and, for Server 2025, to resolve the build-number discrepancy noted above before validating deployment.
Sources
- MSRC Security Update Guide; CVE-2026-70296: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70296
- NVD, CVE-2026-70296: https://nvd.nist.gov/vuln/detail/CVE-2026-70296