Windows Imaging Component: Remote code execution via heap-based buffer overflow

Summary

A heap-based buffer overflow in the Windows Imaging Component allows an unauthenticated attacker to execute code over a network. The CVSS score is 9.8 because no privileges or user interaction are required. Microsoft rates the flaw as not publicly disclosed, not exploited, and less likely to be exploited. Windows 10 Version 1607 and Windows Server 2016 are the highest-risk systems because they reach end of support on October 13, 2026.

Affected

• Windows 10 Version 1607 (builds below 10.0.14393.9612)
• Windows Server 2016 (builds below 10.0.14393.9612)
• Windows 10 Version 1809 (builds below 10.0.17763.9376)
• Windows 10 Version 21H2 (builds below 10.0.19044.7807)
• Windows 10 Version 22H2 (builds below 10.0.19045.7807)
• Windows 11 Version 23H2 (builds below 10.0.22631.7652)
• Windows 11 Version 24H2 (builds below 10.0.26100.9711)
• Windows 11 Version 25H2 (builds below 10.0.26200.9711)
• Windows 11 Version 26H1 (builds below 10.0.28000.3231)
• Windows 11 Version 26H2 (builds below 10.0.26300.9711)
• Windows Server 2012 and 2012 R2 (see MSRC for the fixed builds, as the sources conflict)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612 (per NVD mirror; confirm on MSRC)
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.9711
• Windows Server 2012 and 2012 R2: Unknown, verify on MSRC

Workaround

Unknown. No vendor workaround or interim mitigation was found in the sources. Check the Mitigations and Workarounds sections of the MSRC advisory.

Exploitation

• Microsoft (at publication): not publicly disclosed, not exploited, exploitability assessment 'Exploitation Less Likely'
• CISA SSVC: exploitation none, automatable yes, technical impact total
• No public proof of concept found
• Conflicting signal: a third-party Patch Tuesday summary mentions one actively exploited CISA KEV entry without naming the CVE; verify in the CISA KEV catalogue

Our recommendation

• Inventory all Windows 10 1607, Windows Server 2016 and Windows Server 2012/2012 R2 systems, including OT and kiosk devices
• Patch affected systems to the fixed build after verifying it on the MSRC advisory
• For Windows 10 1607 devices that cannot be migrated in time, evaluate Extended Security Updates (ESU) eligibility with Microsoft
• Isolate unpatched hosts from network exposure and restrict inbound image or media traffic where possible
• Monitor the MSRC page and CISA KEV for changes in exploitation status

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-69886 msrc.microsoft.com
• OpenCVE: CVE-2026-69886 app.opencve.io
• Vulners NVD mirror: CVE-2026-69886 vulners.com
• Vulners VulnRichment: CVE-2026-69886 vulners.com
• Senserva: Patch Tuesday October 2026 senserva.com
• 4sysops: Windows 10 Enterprise LTSB 2016 end of support and ESU 4sysops.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:51.