Microsoft Raw Image Extension: Information disclosure via buffer over-read
Summary
A buffer over-read in the Microsoft Raw Image Extension, a Windows system codec used to decode RAW camera files, can leak information from memory. An attacker needs a local foothold and must get a user to open a crafted RAW image, for example from email, a download or a shared folder. The impact is limited to confidentiality, with no integrity or availability impact. Only machines where the extension is installed are affected.
Affected
- Microsoft Raw Image Extension from 2.1.0.0 before 2.4.43.0 (per CVE record)
- Listed platforms: Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H2
Fixed in
- Version 2.4.43.0 according to secondary sources (OffSeq, Strix). Not yet verified against the MSRC advisory.
Workaround
- No workaround documented.
- If the extension cannot be patched promptly, it can be uninstalled via Settings → Apps. RAW thumbnails and previews will then stop working. This is a suggestion, not a vendor recommendation.
Exploitation
- Not known to be exploited.
- CVSS temporal score uses E:U (Unproven).
- Rapid7 lists exploitation as 'Less Likely' and public disclosure as 'No'.
- Public proof of concept: none found, but this is not fully confirmed.
- Not listed in CISA KEV.
Our recommendation
- Check whether the Raw Image Extension is installed (Microsoft Store or Settings → Apps).
- Install the vendor update once the fixed version is confirmed on MSRC.
- Prioritise workstations that handle camera or RAW files.
- Patch the related entries CVE-2026-96202 (remote code execution, CVSS 8.8) and CVE-2026-114169 (CVSS 8.8) first, as they carry a higher severity.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-114166 msrc.microsoft.com
- CVE Record CVE-2026-114166 www.cve.org
- OffSeq Radar: CVE-2026-114166 radar.offseq.com
- Strix: CVE-2026-114166 www.strix.ai
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- Qualys Patch Tuesday October 2026 review blog.qualys.com
- OffSeq Radar: CVE-2026-114169 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:46.
Original description (NVD)
Buffer over-read in Windows Raw Image Extension allows an unauthorized attacker to disclose information locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.