The practical takeaway is straightforward: check the extension’s version when validating remediation, rather than treating an operating-system update check alone as proof that this affected component is fixed.
What the vulnerability exposes
Microsoft’s official advisory states: “Windows Raw Image Extension Information Disclosure Vulnerability: Buffer over-read in Windows Raw Image Extension allows an unauthorized attacker to disclose information locally.”
The weakness is classified as CWE-126, a buffer over-read. In technical terms, this means software reads beyond the intended boundary of a buffer. Here, Microsoft identifies the security consequence as information disclosure—not modification of information or disruption of availability.
The supplied CVSS vector helps explain that distinction:
| Detail | Microsoft advisory value |
|---|---|
| Severity | Important |
| CVSS base score | 5.5 |
| CVSS temporal score | 4.8 |
| CWE | CWE-126 |
| Affected product | Raw Image Extension |
| Exploitation assessment | Exploitation Less Likely |
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
The vector describes a local attack vector, low attack complexity, no privileges required, and required user interaction. Its impact metrics identify high confidentiality impact, with no integrity or availability impact scored and no change in scope.
That combination matters for triage: “local” does not mean the attacker must already hold privileged access. Equally, the requirement for user interaction distinguishes this assessment from an attack that needs no user involvement. These are interpretations of the supplied scoring metrics, not a claim about a specific delivery technique.
Disclosure and exploitation status
Microsoft’s supplied advisory records:
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
The assessment Exploitation Less Likely should inform prioritization, not replace remediation. It is an assessment of exploitation likelihood, whereas the confidentiality impact describes what successful exploitation could accomplish.
Fixed versions and remediation
Microsoft identifies these vendor fixed builds for Raw Image Extension:
| Affected product | Vendor fixed build |
|---|---|
| Raw Image Extension | 2.4.43.0 |
| Raw Image Extension | 2.5.42.0 |
The official remediation is:
For administrators, the useful distinction is between deploying an update and confirming the affected component reached its fixed version. Use the listed fixed builds as component-level validation targets, and record the installed extension version after remediation.
The bottom line: this is an Important information-disclosure fix requiring customer action. Prioritize it according to your environment’s exposure, but close the remediation task with version evidence—not simply with confirmation that a general update cycle completed.