HEIF Image Extension: Use-after-free, remote code execution

Summary

A use-after-free vulnerability (CWE-416) in Microsoft's HEIF Image Extension for Windows allows an attacker to execute code. The official title describes remote code execution, but the CVSS vector is local (AV:L, PR:N, UI:R). In practice, an attacker needs local access or must get a user to open a crafted HEIC/HEIF file, which requires user interaction but no privileges. The CVSS base score is 7.0 (High).

Affected

• Microsoft HEIF Image Extension versions 1.0.0.0 to before 1.2.62.0
• Platforms listed: Windows 10 version 1809, 21H2, 22H2; Windows 11 version 23H2, 24H2, 25H2, 26H1, 26H2

Fixed in

• Update to HEIF Image Extension 1.2.62.0 or later
• Whether Windows 10 builds receive the fix via KB or update channel: Unknown. Verify on the MSRC page.

Workaround

• No workaround documented by the vendor.
• Interim measure until patched: do not open HEIC/HEIF files from unknown email or download sources.

Exploitation

• Publicly disclosed: No
• Exploited in the wild: No (per Microsoft as of publication)
• Exploit code maturity: Unproven
• Not listed in CISA KEV (per Strix)
• No public proof of concept found

Our recommendation

• Deploy HEIF Image Extension 1.2.62.0 or later to all endpoints, prioritising user workstations.
• Verify the installed version on Windows 10 devices directly against the MSRC page.
• Until patched, restrict handling of untrusted HEIC/HEIF files.
• Patch and triage the Outlook zero-day from the same Patch Tuesday cycle first.
• Re-check the MSRC page and CISA KEV, as the status may change.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  OntologicallyGood/property-damage

Research sources

• Microsoft Security Update Guide msrc.microsoft.com
• CVE Record CVE-2026-100204 www.cve.org
• Windows Forum: CVE-2026-100204 HEIF Image Extensions windowsforum.com
• GBHackers: Microsoft November 2026 Patch Tuesday gbhackers.com
• Strix: CVE-2026-100204 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:51.