Windows Image Acquisition: Format string flaw enables local privilege escalation

Summary

Windows Image Acquisition (WIA) contains an externally controlled format string weakness (CWE-134) that allows an authorized local user to elevate privileges. An attacker needs an existing local account and no user interaction is required. Microsoft rates the flaw CVSS 7.8 (High) because a successful escalation grants full confidentiality, integrity and availability impact.

Affected

• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33650

Fixed in

• Fixed builds according to the official affected ranges: Windows 10 21H2 10.0.19044.7807, Windows 10 22H2 10.0.19045.7807, Windows 11 23H2 10.0.22631.7652, Windows 11 24H2 and 25H2 10.0.26100.9711 and 10.0.26200.9711, Windows 11 26H1 10.0.28000.3231, Windows 11 26H2 10.0.26300.9711, Windows Server 2025 10.0.26100.33650
• Verify the exact build and KB article on the MSRC Security Update Guide before rollout.

Workaround

Unknown. No vendor workaround was found in the sources. Rely on the security update and reduce local attack opportunities by limiting local logon rights and enforcing least privilege.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total
• Not listed in CISA KEV
• Microsoft temporal metrics: exploit code maturity unproven (E:U)
• No public proof of concept found. Further exploitation status unknown.

Our recommendation

• Install the Microsoft security update for all affected Windows versions in the normal monthly patch cycle.
• Prioritise multi-user Windows 10 21H2 endpoints and terminal servers, where users are not fully trusted.
• Check whether Windows 10 21H2 clients are enrolled in ESU or LTSC, as this determines whether they receive the fix.
• Limit local logon rights and apply least privilege.
• Re-assess priority if exploitation becomes known or is added to CISA KEV.
• Check the live NVD record, as the NVD status differs between sources.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85842 msrc.microsoft.com
• OpenCVE: CVE-2026-85842 (NVD data and SSVC) app.opencve.io
• Vulners MSCVE record: MS:CVE-2026-85842 vulners.com
• Strix: CVE-2026-85842 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:00.