CVE-2026-73013

CVE-2026-73013 is a heap-based buffer overflow (CWE-122) in the Windows Imaging Component, the built-in Windows framework that decodes and processes image files. The flaw is reachable over the network but requires user interaction (CVSS AV:N with UI:R): an unauthenticated ('unauthorized') attacker must get a user to open or preview a specially crafted image — for example via an email attachment or web-delivered file — causing heap memory corruption in the imaging pipeline. Successful exploitation yields remote code execution running as the logged-on user, with high-rated impacts on confidentiality, integrity, and availability. Any user of the affected Windows versions that ship Windows Imaging Component is exposed, and the issue was addressed as part of Microsoft's September 2026 Patch Tuesday. Exploitation is currently not known: there is no public proof-of-concept, the CVE is not in the CISA KEV catalog, and EPSS assigns a 0.6% probability of exploitation within 30 days (45th percentile).

What to do: Deploy the September 2026 Windows security updates from Microsoft as soon as possible, prioritizing endpoints whose users routinely handle images and documents from untrusted sources. Check Microsoft's advisory for the exact affected Windows versions and builds applicable to your fleet. Until patched, caution users against opening image files from untrusted senders or websites; no in-the-wild exploits or public PoCs are currently known.