Microsoft Windows Imaging Component Out-of-Bounds Write Enables Remote Code Execution

Out-of-bounds write in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

Microsoft identifies the following affected branches. Each branch is affected from the stated baseline build through versions less than the corresponding fixed build:

• Windows 10 Version 1607 and Windows Server 2016, including Server Core: starts at 10.0.14393.0 and is less than 10.0.14393.9512; fixed in 10.0.14393.9512.
• Windows 10 Version 1809 and Windows Server 2019, including Server Core: starts at 10.0.17763.0 and is less than 10.0.17763.9245; fixed in 10.0.17763.9245.
• Windows 10 Version 21H2: starts at 10.0.19044.0 and is less than 10.0.19044.7725; fixed in 10.0.19044.7725.
• Windows 10 Version 22H2: starts at 10.0.19045.0 and is less than 10.0.19045.7725; fixed in 10.0.19045.7725.
• Windows 11 Version 23H2: starts at 10.0.22631.0 and is less than 10.0.22631.7582; fixed in 10.0.22631.7582.
• Windows 11 Version 24H2: starts at 10.0.26100.0 and is less than 10.0.26100.9445; fixed in 10.0.26100.9445.
• Windows 11 Version 25H2: starts at 10.0.26200.0 and is less than 10.0.26200.9445; fixed in 10.0.26200.9445.
• Windows 11 version 26H1: starts at 10.0.28000.0 and is less than 10.0.28000.2954; fixed in 10.0.28000.2954.
• Windows Server 2012, including Server Core: starts at 6.2.9200.0 and is less than 6.2.9200.26349; fixed in 6.2.9200.26349.
• Windows Server 2012 R2, including Server Core: starts at 6.3.9600.0 and is less than 6.3.9600.23398; fixed in 6.3.9600.23398.
• Windows Server 2022: starts at 10.0.20348.0 and is less than 10.0.20348.5622; fixed in 10.0.20348.5622.
• Windows Server 2025, including Server Core: starts at 10.0.26100.0 and is less than 10.0.26100.33438; fixed in 10.0.26100.33438.

The normalized record contains two duplicate entries for Windows 11 Version 23H2; it is listed once above. The status of branches or products not identified in this evidence is not inferred.

Microsoft Windows Imaging Component contains an out-of-bounds write classified as CWE-787. When the component processes attacker-controlled data, the write can extend beyond the intended memory boundary and lead to code execution on the affected system. The record establishes network reachability, no required prior privileges, and no user interaction, but it does not identify the specific data format, endpoint, API, function, or code path that triggers the flaw. The exact payload and exploitation sequence therefore remain unknown from the available evidence.

• The assessed attack path is network reachable, with low complexity, no required authentication, and no user interaction.
• Successful exploitation can result in code execution on an affected Windows system.
• The supplied record does not identify a public exploit; CISA ADP data returned during research records exploitation as none at the time of that assessment. This does not rule out future exploitation.
• No evidence identifies this vulnerability as part of a named ransomware campaign or a specifically documented exploitation campaign.

• The flaw can lead to remote code execution on an affected Windows system after network-delivered data is processed.
• Successful exploitation could affect data confidentiality, data or configuration integrity, and service availability.
• The assessed conditions require no prior privileges and no user interaction, reducing the number of prerequisites for an attack.
• The assessed scope remains unchanged, so the described consequences are centered on the compromised Windows system.
• Available public evidence does not identify the specific privilege level under which attacker-controlled code would run or describe a path across another security boundary.

• A workstation or server may become a remote code execution target if it runs an affected build and is reachable over the network.
• Possible consequences include loss of data confidentiality, unauthorized changes to data or configuration, and service disruption on the compromised system.
• Server Core deployments are included in several affected branches, so review should not be limited to Windows systems with a graphical interface.
• The record provides no evidence of a specific breach, named victim, or active campaign exploiting this vulnerability.

1. Install Microsoft's security update for the applicable product branch. Microsoft identifies these fixed builds and updates:

• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.9245, security update KB5122876.
• Windows Server 2022: 10.0.20348.5622, security update KB5122882.
• Windows 10 Version 21H2: 10.0.19044.7725, security update KB5122878.
• Windows 10 Version 22H2: 10.0.19045.7725, security update KB5122878.
• Windows 11 Version 23H2: 10.0.22631.7582, security update KB5122880.
• Windows Server 2025: 10.0.26100.33438, security update KB5122871.
• Windows 11 Version 24H2: 10.0.26100.9445, security update KB5124008.
• Windows 11 Version 25H2: 10.0.26200.9445, security update KB5124008.
• Windows 11 version 26H1: 10.0.28000.2954, security update KB5124012.
• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9512, security update KB5123099.
• Windows Server 2012: 6.2.9200.26349, monthly rollup KB5123065.
• Windows Server 2012 R2: 6.3.9600.23398, monthly rollup KB5123066.

1. Verify after deployment that each system reaches the fixed build for its specific branch. Do not treat a downloaded update or a started update task as proof that the system is protected.
2. Prioritize systems that can receive untrusted network connections, then extend validation to internal servers and Server Core deployments.
3. The available evidence does not identify an alternative vendor mitigation. Any temporary exposure-reduction measures should not be treated as a replacement for the security update.

1. Inventory Microsoft Windows workstations and servers that use Windows Imaging Component, including Server Core deployments.
2. Compare each asset's product branch and OS build with the affected boundaries and fixed builds listed below.
3. Check the corresponding security update state in the organization's patch-management or compliance tooling, then recheck the installed build after any required restart.
4. Prioritize systems that can receive untrusted network traffic or are exposed across broader network zones.
5. The available evidence does not provide a CVE-specific IOC or distinctive log event. General monitoring for unusual crashes or suspicious process activity may be used as a precaution, but the absence of such telemetry does not establish safety.