CVE-2026-69860

CVE-2026-69860 is a heap-based buffer overflow (CWE-122) in the Windows Imaging Component, the built-in Windows subsystem responsible for decoding image formats. An unauthenticated remote attacker can trigger the flaw by getting a user to open or preview a specially crafted image file (the CVSS vector is network-based but requires user interaction). Successful exploitation allows arbitrary code execution in the context of the affected user, with high impact on confidentiality, integrity, and availability. Any Windows installation carrying the affected Imaging Component is exposed, and the fix is distributed through Microsoft's September 2026 security updates. There is currently no known in-the-wild exploitation, no public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.8%.

What to do: Deploy Microsoft's September 2026 security updates on all Windows clients and servers as part of this month's Patch Tuesday cycle, prioritizing end-user workstations where users routinely open images from email, the web, or file shares. Until patching is complete, exercise caution with untrusted image files and attachments. Verify that the WIC-related update for CVE-2026-69860 is included in your organization's September 2026 patch compliance reporting.