CVE-2026-70296

CVE-2026-70296 is a critical (CVSS 9.8) out-of-bounds write vulnerability (CWE-787) in the Windows Imaging Component (WIC), the built-in Microsoft Windows component that handles image and codec processing. Per the advisory and CVSS vector, an unauthorized attacker can trigger the flaw over a network without credentials or user interaction, though the available data does not specify the exact trigger path. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability of the affected system. Because WIC ships as a standard part of Windows, essentially every system running an affected Windows build is exposed until patched. As of the data available, there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at 1.0% (60th percentile); fixes were distributed as part of Microsoft's September 2026 Patch Tuesday, with Snort detection rules published.

What to do: Apply the September 2026 Microsoft security updates for CVE-2026-70296 as soon as possible, prioritizing internet-facing and shared Windows systems, and verify against the affected builds listed in the Microsoft advisory. Until patched, deploy the Snort rules released alongside the September 2026 Patch Tuesday to detect exploitation attempts. Inventory Windows assets for pending Patch Tuesday status to confirm remediation coverage.