CVE-2026-73013 - Windows Imaging Component Remote Code Execution Vulnerability

Back Back to CVE browser

HIGH

Windows Imaging Component Remote Code Execution Vulnerability

Published Sep 8, 2026

8.8

HIGH

CVSS 3.1

EPSS 0.82%

Description

Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

Affected products

Vendor Microsoft Product Windows 10 Version 1607 Default
unknown
Affected
- ≥ 10.0.14393.0, < 10.0.14393.9512
Vendor Microsoft Product Windows 10 Version 1809 Default
unknown
Affected
- ≥ 10.0.17763.0, < 10.0.17763.9245
Vendor Microsoft Product Windows 10 Version 21H2 Default
unknown
Affected
- ≥ 10.0.19044.0, < 10.0.19044.7725
Vendor Microsoft Product Windows 10 Version 22H2 Default
unknown
Affected
- ≥ 10.0.19045.0, < 10.0.19045.7725
Vendor Microsoft Product Windows 11 Version 23H2 Default
unknown
Affected
- ≥ 10.0.22631.0, < 10.0.22631.7582
Vendor Microsoft Product Windows 11 Version 24H2 Default
unknown
Affected
- ≥ 10.0.26100.0, < 10.0.26100.9445
Vendor Microsoft Product Windows 11 Version 25H2 Default
unknown
Affected
- ≥ 10.0.26200.0, < 10.0.26200.9445
Vendor Microsoft Product Windows 11 version 23H2 Default
unknown
Affected
- ≥ 10.0.22631.0, < 10.0.22631.7582
Vendor Microsoft Product Windows 11 version 26H1 Default
unknown
Affected
- ≥ 10.0.28000.0, < 10.0.28000.2954
Vendor Microsoft Product Windows Server 2012 Default
unknown
Affected
- ≥ 6.2.9200.0, < 6.2.9200.26349
Vendor Microsoft Product Windows Server 2012 (Server Core installation) Default
unknown
Affected
- ≥ 6.2.9200.0, < 6.2.9200.26349
Vendor Microsoft Product Windows Server 2012 R2 Default
unknown
Affected
- ≥ 6.3.9600.0, < 6.3.9600.23398
Vendor Microsoft Product Windows Server 2012 R2 (Server Core installation) Default
unknown
Affected
- ≥ 6.3.9600.0, < 6.3.9600.23398
Vendor Microsoft Product Windows Server 2016 Default
unknown
Affected
- ≥ 10.0.14393.0, < 10.0.14393.9512
Vendor Microsoft Product Windows Server 2016 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.14393.0, < 10.0.14393.9512
Vendor Microsoft Product Windows Server 2019 Default
unknown
Affected
- ≥ 10.0.17763.0, < 10.0.17763.9245
Vendor Microsoft Product Windows Server 2019 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.17763.0, < 10.0.17763.9245
Vendor Microsoft Product Windows Server 2022 Default
unknown
Affected
- ≥ 10.0.20348.0, < 10.0.20348.5622
Vendor Microsoft Product Windows Server 2025 Default
unknown
Affected
- ≥ 10.0.26100.0, < 10.0.26100.33438
Vendor Microsoft Product Windows Server 2025 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.26100.0, < 10.0.26100.33438

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Microsoft	Windows 10 Version 1607	unknown	Affected ≥ 10.0.14393.0, < 10.0.14393.9512
Microsoft	Windows 10 Version 1809	unknown	Affected ≥ 10.0.17763.0, < 10.0.17763.9245
Microsoft	Windows 10 Version 21H2	unknown	Affected ≥ 10.0.19044.0, < 10.0.19044.7725
Microsoft	Windows 10 Version 22H2	unknown	Affected ≥ 10.0.19045.0, < 10.0.19045.7725
Microsoft	Windows 11 Version 23H2	unknown	Affected ≥ 10.0.22631.0, < 10.0.22631.7582
Microsoft	Windows 11 Version 24H2	unknown	Affected ≥ 10.0.26100.0, < 10.0.26100.9445
Microsoft	Windows 11 Version 25H2	unknown	Affected ≥ 10.0.26200.0, < 10.0.26200.9445
Microsoft	Windows 11 version 23H2	unknown	Affected ≥ 10.0.22631.0, < 10.0.22631.7582
Microsoft	Windows 11 version 26H1	unknown	Affected ≥ 10.0.28000.0, < 10.0.28000.2954
Microsoft	Windows Server 2012	unknown	Affected ≥ 6.2.9200.0, < 6.2.9200.26349
Microsoft	Windows Server 2012 (Server Core installation)	unknown	Affected ≥ 6.2.9200.0, < 6.2.9200.26349
Microsoft	Windows Server 2012 R2	unknown	Affected ≥ 6.3.9600.0, < 6.3.9600.23398
Microsoft	Windows Server 2012 R2 (Server Core installation)	unknown	Affected ≥ 6.3.9600.0, < 6.3.9600.23398
Microsoft	Windows Server 2016	unknown	Affected ≥ 10.0.14393.0, < 10.0.14393.9512
Microsoft	Windows Server 2016 (Server Core installation)	unknown	Affected ≥ 10.0.14393.0, < 10.0.14393.9512
Microsoft	Windows Server 2019	unknown	Affected ≥ 10.0.17763.0, < 10.0.17763.9245
Microsoft	Windows Server 2019 (Server Core installation)	unknown	Affected ≥ 10.0.17763.0, < 10.0.17763.9245
Microsoft	Windows Server 2022	unknown	Affected ≥ 10.0.20348.0, < 10.0.20348.5622
Microsoft	Windows Server 2025	unknown	Affected ≥ 10.0.26100.0, < 10.0.26100.33438
Microsoft	Windows Server 2025 (Server Core installation)	unknown	Affected ≥ 10.0.26100.0, < 10.0.26100.33438

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-122

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-73777
Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-73013
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-73777		Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-73013		vendor-advisorypatchVendor Advisory

Change history (1)

Oct 7, 2026, 22:29 UTC EUVD
- Updated
  changed from Oct 1, 2026 to Oct 7, 2026

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Sep 8, 2026

Updated Oct 7, 2026

Reserved Aug 10, 2026

Link CVE-2026-73013

CISA Vulnrichment

Updated Sep 9, 2026

NVD

Status Analyzed

Modified Sep 17, 2026

Link CVE-2026-73013

Red Hat

No data

ENISA EUVD

Assigner microsoft

Published Sep 8, 2026

Updated Oct 7, 2026

Link EUVD-2026-73777

GitHub

No data