CVE-2026-96943: Windows Raw Image Extension Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
Other sources
Windows Raw Image Extension Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.5.35.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.36.0
Event History
Frequently Asked Questions
What attacker interaction is required for exploitation?
The attacker must cause a user to interact with malicious content; the vector is network-based, but the CVSS data indicates user interaction is required.
Does an attacker need an account or existing privileges?
No. The vulnerability is rated PR:N, indicating that an attacker does not need prior privileges or authentication to attempt exploitation.
What is the likely impact of successful exploitation?
Successful exploitation could allow code execution with high impact to confidentiality, integrity, and availability, according to the CVSS metrics.