Windows Image Acquisition: Double free leading to remote code execution

Summary

A double free vulnerability (CWE-415) in the Windows Image Acquisition (WIA) component allows an unauthorized attacker to execute code over a network. According to the CVSS vector, exploitation requires high attack complexity and user interaction. Exposure depends on whether WIA can be reached from the network without user action on typical systems, which is not yet confirmed.

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (builds 10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds 10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds 10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds 10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds 10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds 10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds 10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds 10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (builds 10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (builds 10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (builds 10.0.20348.0 to before 10.0.20348.5870)

Fixed in

• Install the Windows update that brings the build to or above the fixed version listed for each product, as stated in the CNA record: 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974, 10.0.20348.5870.
• KB numbers for the November 2026 updates are not confirmed for this CVE. Verify them on the MSRC advisory before deployment.

Workaround

• No vendor mitigation identified. Patching is the only confirmed fix.
• Unverified option: if WIA is not required on a host, disabling the Windows Image Acquisition service (StiSvc) may reduce exposure. Test first and check against MSRC guidance.
• Restrict network access to affected hosts, especially servers, and block untrusted inbound traffic at the perimeter.

Exploitation

• Unknown. No public proof of concept, CISA KEV entry or vendor exploited flag was found at the time of research.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.

Our recommendation

• Include the fix in the November 2026 update cycle and prioritize servers and workstations that process externally sourced files or scanner and camera input.
• Check for Windows 10 systems still in use and verify their support and ESU status.
• Restrict network reachability to affected hosts and monitor for unusual activity on them.
• Confirm the fixed builds and KB numbers on the MSRC advisory and check for exploitation reports after publication.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-122163 advisory msrc.microsoft.com
• CVE Record CVE-2026-122163 (CNA: Microsoft) www.cve.org
• Strix CVE-2026-122163 (secondary, unverified) www.strix.ai
• Action1 Patch Tuesday November 2026 roundup www.action1.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:20.