Microsoft Windows Imaging Component: Remote code execution via heap-based buffer overflow

Summary

A heap-based buffer overflow in the Windows Imaging Component allows an unauthenticated attacker to execute code remotely on affected Windows systems. The attacker needs a user to take an action, such as opening or previewing a crafted image file or visiting a malicious page. Exploitation is not known, and no public proof of concept was found.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 and 22H2 (10.0.19044.0 to before 10.0.19044.7807; 10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2, 25H2 and 26H2 (10.0.26100.0 to before 10.0.26100.9711; 10.0.26200.0 to before 10.0.26200.9711; 10.0.26300.0 to before 10.0.26300.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows Server 2012 and 2012 R2, including Server Core (6.2.9200.0 to before 6.2.9200.26434; 6.3.9600.0 to before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)

Fixed in

• Fixed builds as listed in the Microsoft Security Update Guide, for example 10.0.14393.9612 for Windows 10 1607 and Server 2016 (not yet confirmed against the primary source)
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2: 10.0.26100.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows Server 2012 and 2012 R2: 6.2.9200.26434 and 6.3.9600.23470
• Cumulative updates for October 2026 (reported): KB5126646 (Server 2025), KB5126651 (Windows 10 1809 / Server 2019), KB5126653 (Windows 11 23H2)
• KB number for Windows 10 1607 / Server 2016: Unknown.

Workaround

Unknown. No vendor workaround was found in the sources reviewed. Check the Microsoft Security Update Guide for mitigation details.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in CISA KEV; not reported as exploited.
• No public proof of concept found in the sources reviewed; this does not rule one out.
• EPSS below 1%.

Our recommendation

• Install the October 2026 security update on all affected Windows hosts and verify the build numbers afterwards.
• Prioritise internet-facing servers, mail and file servers, and hosts where users open untrusted images.
• Windows 10 1607 and Server 2012 are old builds: check the Microsoft lifecycle pages and plan replacement if no patches are available.
• Monitor for exploit reports and KEV additions.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-77496 msrc.microsoft.com
• OpenCVE: CVE-2026-77496 app.opencve.io
• Vulners NVD record: CVE-2026-77496 vulners.com
• Senserva: KB5126653 senserva.com
• Strix: CVE-2026-77496 (third-party) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:41.