AI analysis
CVE-2026-96202 is a heap-based buffer overflow (CWE-122) in Microsoft's Windows Raw Image Extension. A remote attacker can trigger it over the network without prior privileges if a user opens a crafted RAW image (CVSS 3.1 base score 8.8, AV:N/AC:L/PR:N/UI:R). Successful exploitation can give the attacker code execution in the context of the user who opened the file, with high impact to confidentiality, integrity, and availability. Windows systems that have the Raw Image Extension installed are affected; exact build ranges were not included in the CVE record and are covered by Microsoft's October 2026 Patch Tuesday updates. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Install Microsoft's October 2026 security updates that patch Windows Raw Image Extension as soon as they are available for your Windows build. Until then, do not open RAW image files from untrusted email, web, or network sources, and prefer viewing such files only after they have been scanned. Confirm the extension is updated via Windows Update or the Microsoft Store and that the host is fully patched.
Affected
| Microsoft Windows Raw Image Extension | — |
Estimated exposure
massOn the order of 100 million or more Windows PCs that include Raw Image Extension (estimate) — Windows 10 and Windows 11 are installed on hundreds of millions of PCs, and Raw Image Extension is a commonly shipped Microsoft component for viewing camera RAW files, so a large share of those clients is plausibly exposed even though…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.