CVE-2026-100204: HEIF Image Extensions Remote Code Execution Vulnerability

While a vulnerability in an image codec might sound like a classic "view a file, lose your machine" scenario, the official metrics tell a more nuanced story about what it actually takes to pull off an attack. Below is a full technical breakdown of the MSRC advisory, the underlying mechanics of the flaw, and what you need to do to ensure your systems are running the fixed build.

Executive Summary & Official Advisory Metrics​

According to the official MSRC vulnerability data, CVE-2026-100204 carries a CVSS v3.1 base score of 7.0 and a temporal score of 6.1. The core description from Microsoft states: "Use after free in HEIF Image Extensions allows an unauthorized attacker to execute code locally."

Here are the verified classification and status details directly from the MSRC release:

• CVE ID: CVE-2026-100204
• Title: HEIF Image Extensions Remote Code Execution Vulnerability
• Severity: Important
• Affected Product: HEIF Image Extension
• Weakness Classification: CWE-416 (Use After Free)
• CVSS Base Score: 7.0
• CVSS Temporal Score: 6.1
• CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• Publicly disclosed: No
• Exploited: No
• Exploitation Assessment: Exploitation Less Likely
• Customer action required: Yes
• Fixed Build: 1.2.62.0
• Official Remediation: For HEIF Image Extension, update to fixed build 1.2.62.0 or later.

Summary: CVE-2026-100204 is an Important-severity use-after-free vulnerability (CWE-416) in HEIF Image Extension with a 7.0 base score. It has not been publicly disclosed or exploited, and Microsoft assesses exploitation as less likely, though customer action is required to update to build 1.2.62.0 or later.

Unpacking the Technical Details: CWE-416 and Attack Complexity​

At the heart of CVE-2026-100204 is CWE-416, known in software security as a Use After Free flaw. Based on general industry knowledge of memory-unsafe code in native media parsers, a use-after-free condition occurs when a program allocates a block of memory to process data—such as decoding image metadata, color profiles, or frame buffers in a High Efficiency Image File (HEIF) container—subsequently frees that memory, and then mistakenly continues to reference the dangling pointer. If an attacker can craft a malformed file that forces the application to free that memory and immediately fill the vacated heap space with malicious data before the pointer is called again, the program may execute the attacker's payload instead of legitimate instructions.

You might notice an apparent contradiction between the official title—HEIF Image Extensions Remote Code Execution Vulnerability—and the official description, which states that the flaw "allows an unauthorized attacker to execute code locally." Examining the CVSS v3.1 vector (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) clarifies how those pieces fit together:

1. Attack Vector: Local (AV:L) & User Interaction: Required (UI:R): The vulnerability is triggered locally on the target system and requires a user to interact with the malicious content—for example, opening a specially crafted image file delivered via email, web download, or removable media, or browsing a local directory where Windows parses the file.
2. Privileges Required: None (PR:N): The attacker does not need existing credentials or administrative rights prior to triggering the flaw through user interaction.
3. High Impact (C:H/I:H/A:H) within an Unchanged Scope (S:U): If an exploit succeeds, the attacker gains high impact over confidentiality, integrity, and availability within the security context of the user running the extension.
4. Attack Complexity: High (AC:H): Turning a heap memory corruption bug into reliable code execution on modern Windows systems is notoriously difficult.

Microsoft addresses this exact hurdle in its official advisory facts for CVE-2026-100204:

"According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to have a deep understanding of the system. Successful exploitation is not guaranteed and depends on a combination of factors that might include the environment, system configuration, and the presence of additional security measures."

Click to expand...

Why does this matter to defenders? Because a use-after-free bug is rarely a simple point-and-shoot exploit. Reliable exploitation often requires precise heap grooming and bypassing built-in OS mitigations. Consequently, Microsoft's threat intelligence team has assigned an assessment of Exploitation Less Likely, reinforced by the temporal metrics indicating unproved exploit maturity (E:U), an official fix (RL:O), and confirmed report confidence (RC:C).

Summary: While a successful exploit compromises confidentiality, integrity, and availability within the local user context, the combination of required user interaction (UI:R) and high attack complexity (AC:H) makes reliable exploitation dependent on deep system knowledge and specific environmental factors.

Remediation and Verification Guide for Windows Users and Admins​

Notice that in the official MSRC data for CVE-2026-100204, Customer action required: Yes is explicitly set, while no traditional cumulative update KB number is attached to the build entry. That is because HEIF Image Extension is distributed and serviced as an AppX/MSIX package rather than through a standard monthly Windows OS cumulative update KB.

To remediate this vulnerability: For HEIF Image Extension, update to fixed build 1.2.62.0 or later.

How to Verify Your Installed Build via PowerShell​

Whether you are auditing a single workstation or checking endpoints across a domain, you can verify the exact version of the installed HEIF package using Windows PowerShell. Run the following command:

Get-AppxPackage -Name *HEIFImageExtension* | Select-Object Name, Version

• What Success Looks Like: Check the Version column in the output. If the version number is 1.2.62.0 or higher, the system has received the patch for CVE-2026-100204.
• If the Version is Older: Open the Microsoft Store application on the Windows device, navigate to the Library section, and click Get updates to pull the latest package build.
• Enterprise Considerations: In tightly locked-down enterprise environments where access to the Microsoft Store is blocked via Group Policy or Intune, automatic store app updates may fail silently. IT administrators who prohibit public Store traffic should verify whether HEIF Image Extension is deployed on managed images and, if present, distribute fixed build 1.2.62.0 or later through their internal software management pipeline (such as Microsoft Intune or Configuration Manager) or remove the extension if HEIF media support is not required by business workflows.

Summary: Because HEIF Image Extension updates outside traditional KB patches, users and administrators must ensure that build 1.2.62.0 or later is installed via the Microsoft Store or enterprise application management tools.