Windows Imaging Component: Heap-based buffer overflow enables code execution

Summary

The Windows Imaging Component in supported and older Windows 10 and Windows 11 builds, and in Windows Server 2016, 2019 and 2022, contains a heap-based buffer overflow (CWE-122). According to the CVE record, an unauthorized attacker can execute code over a network. The CVSS vector requires user interaction, so an attacker most likely needs a user to open or preview a crafted image or file; this is not confirmed on the vendor page. NVD analysis was still pending at publication.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2016, including Server Core (builds before 10.0.14393.9688)
• Windows Server 2019, including Server Core (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)

Fixed in

• Fixed builds per the CVE record are listed above as the first build without the flaw.
• The minimum fixed builds for Windows 10 1607, 1809, 21H2, 22H2 and Windows 11 23H2 come from a third-party aggregator and are unverified; confirm them on the Microsoft Security Update Guide.
• Fixes are delivered through the monthly cumulative security updates.

Workaround

• Unknown. No vendor mitigation guidance was found.
• Applying the security update is the remedy.

Exploitation

• Not known to be exploited at the time of research.
• No public proof of concept was found; this does not rule out that one exists.
• No entry in the CISA KEV catalogue was found.

Our recommendation

• Inventory all Windows 10, Windows 11 and Windows Server systems by build and edition, and prioritise Windows 10 1607.
• Confirm affected and fixed builds on the Microsoft Security Update Guide and deploy the current cumulative update.
• Where Windows 10 1607 is out of support, plan an upgrade or enrol in Extended Security Updates if eligible.
• Restrict or review image previews and image processing on mail, file and print servers, and monitor NVD, MSRC and CISA KEV for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96164 msrc.microsoft.com
• Microsoft Security Update Guide: 2026-Jul release notes msrc.microsoft.com
• OffSeq Radar: CVE-2026-96164 (aggregator, unverified build data) radar.offseq.com
• CSA Singapore advisory AL-2026-103 (context) www.csa.gov.sg

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:51.