CVE-2026-69499

CVE-2026-69499 is an integer overflow/wraparound flaw (CWE-190) in the Windows Imaging Component (WIC), the Windows subsystem that decodes image formats such as those used by photos, previews, and thumbnails. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates an unauthenticated remote attacker must induce user interaction, most plausibly by having a user open or preview a specially crafted image file delivered over a network. Successful exploitation would allow the attacker to execute arbitrary code in the context of the affected user, with high impact on confidentiality, integrity, and availability. Because WIC is a built-in Windows component, any Windows system that processes images from untrusted sources is affected; the source data does not enumerate specific affected Windows versions. As of the reported data there is no known exploitation, no public proof-of-concept, and the flaw is not in CISA KEV, with EPSS estimating only a 0.8% chance of exploitation within 30 days.

What to do: Install the Windows security updates released in Microsoft's September 2026 Patch Tuesday as they become available to your environment, prioritizing endpoints and servers where users routinely open untrusted image files. Because the affected Windows version list was not provided in the source data, consult Microsoft's advisory to confirm which builds your estate runs and ensure updates cover them. There are no published workarounds, so patching is the primary mitigation; monitor the dashboard for exploitation indicators given the EPSS score may rise if a PoC emerges.