CVE-2026-114169: Windows Raw Image Extension Remote Code Execution Vulnerability

Q: What does an attacker need to exploit this vulnerability?

The attacker can be unauthorized and attack over the network, but exploitation requires user interaction. The available data does not specify the exact user action or delivery mechanism.

Q: What is the potential impact if exploitation succeeds?

Successful exploitation can allow remote code execution with high impact to confidentiality, integrity, and availability.

Q: Which component should be prioritized for investigation and remediation?

Systems using Microsoft Raw Image Extension should be prioritized, because the heap-based buffer overflow is identified in that component. The provided data does not identify affected versions or configurations.

Published Nov 10, 2026

Updated

Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.

Other sources

Windows Raw Image Extension Remote Code Execution Vulnerability

— Microsoft

Affected Software

3 affected componentsFixes available

Microsoft Raw Image Extension<2.5.42.0

2.5.42.0

Microsoft Raw Image Extension<2.4.43.0

2.4.43.0

Microsoft Raw Image Extension

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.5.42.0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.43.0

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:15 PM

Data Sourced

via MITRE·06:15 PM

DescriptionSeverity

Data Sourced

via NVD·07:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this vulnerability?

The attacker can be unauthorized and attack over the network, but exploitation requires user interaction. The available data does not specify the exact user action or delivery mechanism.

What is the potential impact if exploitation succeeds?

Successful exploitation can allow remote code execution with high impact to confidentiality, integrity, and availability.

Which component should be prioritized for investigation and remediation?

Systems using Microsoft Raw Image Extension should be prioritized, because the heap-based buffer overflow is identified in that component. The provided data does not identify affected versions or configurations.

CVE-2026-114169: Windows Raw Image Extension Remote Code Execution Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this vulnerability?

What is the potential impact if exploitation succeeds?

Which component should be prioritized for investigation and remediation?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this vulnerability?

What is the potential impact if exploitation succeeds?

Which component should be prioritized for investigation and remediation?