CVE-2026-96202: Windows Raw Image Extension Remote Code Execution Vulnerability

Critical Security Alert: CVE-2026-96202 Targets Raw Image Extension​

Media parsers and image codecs are some of the quietest workhorses on a PC, silently rendering everything from family vacation photos to professional camera files without demanding a second thought. However, because these components automatically process complex, untrusted file structures, they remain a prime target for memory corruption bugs. Microsoft has issued an official security advisory for CVE-2026-96202, titled Windows Raw Image Extension Remote Code Execution Vulnerability.

Rated as Critical severity, this flaw carries a CVSS base score of 8.8 and a CVSS temporal score of 7.7. According to the Microsoft Security Response Center (MSRC), the issue is this exact weakness: "Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network."

While automatic updates via the Microsoft Store handle most modern app extensions quietly in the background, enterprise administrators who restrict Store traffic or manage offline imaging workstations need to pay close attention. Because Customer action required: Yes applies to this release, verifying that your systems have received the patched builds is essential to closing off this attack vector.

Vulnerability Breakdown and Official Advisory Facts​

To understand the precise nature of CVE-2026-96202, we can look directly at the technical parameters established in the MSRC dossier. The vulnerability is classified under CWE-122, which denotes a heap-based buffer overflow. In general industry terms, a heap-based buffer overflow occurs when a program writes more data to a dynamically allocated block of memory (the heap) than that buffer was designed to hold. When parsing an image file, if the codec fails to properly validate header lengths or pixel data boundaries before copying them into memory, adjacent memory structures can be overwritten. If an attacker carefully arranges that overflow data, they can hijack the application's execution flow and run arbitrary code.

Here is the complete technical profile for CVE-2026-96202:

• CVE ID: CVE-2026-96202
• Exact Title: Windows Raw Image Extension Remote Code Execution Vulnerability
• Affected Product: Raw Image Extension
• Severity: Critical
• CVSS Base Score: 8.8
• CVSS Temporal Score: 7.7
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness Enumeration: CWE-122
• Exploitation Assessment: Exploitation Less Likely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Analyzing the Attack Vector and Target Context​

A quick glance at the CVSS vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I/H/A:H/E:U/RL:O/RC:C) tells a very specific story about how an attack unfolds in practice. Even though the attack vector is listed as Network (AV:N), the attack complexity is Low (AC:L), and no privileges are required (PR:N), this is not a self-propagating "wormable" flaw that can compromise a machine simply by sending packets to an open port. Notice the UI:R metric—User Interaction is Required.

MSRC's official advisory facts address this nuance directly:

• "Windows Raw Image Extension Remote Code Execution Vulnerability: Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network."
• "According to the CVSS metric, the attack vector is network (AV:N) and user interaction is required (UI:R). What is the target context of the remote code execution? This attack requires a user to open a specially crafted file from the attacker to initiate remote code execution."

What does that mean for everyday users and IT defenders? An attacker cannot trigger the buffer overflow entirely on their own from across the internet; instead, they must deliver a malicious, specially crafted raw image file—perhaps via email, a messaging platform, a shared network drive, or a web download—and convince the target user to open it. If the user opens the booby-trapped file on a system with a vulnerable version of Raw Image Extension, the resulting compromise offers High impacts across Confidentiality (C:H), Integrity (I:H), and Availability (A:H) within the unchanged scope (S:U) of the user's current security context.

Fortunately, defenders have time on their side. The official statuses confirm Publicly disclosed: No and Exploited: No, paired with an official MSRC assessment of Exploitation Less Likely. The temporal vector metrics further reflect that an official fix is available (RL:O) and report confidence is confirmed (RC:C).

Section Summary: CVE-2026-96202 is a Critical (CVSS 8.8 base, 7.7 temporal) CWE-122 heap-based buffer overflow in Raw Image Extension. While it operates over a network vector without requiring privileges, an attacker must still trick a user into opening a specially crafted file to achieve remote code execution.

Remediation, Fixed Builds, and Store Updates​

Because Raw Image Extension is distributed and serviced as a Microsoft Store package rather than through traditional monthly cumulative OS KB packages, there is no specific KB number associated with these patches. Instead, remediation relies on updating the extension package to the appropriate fixed build via the Microsoft Store update mechanism.

To resolve CVE-2026-96202, administrators and users must follow the exact remediation guidance provided by Microsoft: For Raw Image Extension, update to fixed build 2.4.36.0 or later; update to fixed build 2.5.35.0 or later.

How to Verify and Apply the Update​

Why are two separate fixed builds—2.4.36.0 and 2.5.35.0—listed for Raw Image Extension? Based on general industry knowledge of Microsoft Store app servicing, Microsoft frequently maintains parallel servicing branches for Store extensions to support different host operating system baselines or feature rings. Regardless of which branch is installed on your device, ensuring your build meets or exceeds 2.4.36.0 (for the 2.4 branch) or 2.5.35.0 (for the 2.5 branch) will mitigate the vulnerability.

For standard home and pro workstations with Microsoft Store access enabled:

1. Open the Microsoft Store application.
2. Navigate to Library in the lower-left corner of the window.
3. Click Get updates to force a check for the latest app and extension packages, allowing Raw Image Extension to update to fixed build 2.4.36.0 or 2.5.35.0 (or later).

For enterprise IT administrators, relying on manual user checks is rarely sufficient—especially in environments where the Microsoft Store is blocked by Group Policy or mobile device management (MDM) profiles. Synthesizing from standard Windows administration practices, you can audit the installed version of Raw Image Extension across your fleet using PowerShell (Get-AppxPackage) to query the installed package version. If your organization blocks automatic Microsoft Store updates, you should ensure your endpoint management solution is configured to allow or deploy updated Store app packages so that endpoints do not remain stranded on vulnerable builds prior to 2.4.36.0 or 2.5.35.0.

Practical Defense-in-Depth​

While applying the update is the definitive fix, what does this vulnerability remind us about workstation hygiene?

• Treat untrusted media files with caution: Because this exploit requires a user to open a specially crafted file from an attacker, standard anti-phishing awareness remains a strong secondary barrier. Users should avoid opening raw image attachments or archives from unrecognized senders.
• Principle of least privilege: Since the CVSS scope is Unchanged (S:U), any code executed via a heap-based buffer overflow runs with the privileges of the user who opened the file. Running daily tasks under a standard user account rather than a local administrator account significantly limits the blast radius of any file-parsing vulnerability.

Section Summary: Because Customer action required: Yes is in effect for CVE-2026-96202, users and administrators must ensure Raw Image Extension is updated through the Microsoft Store. Specifically, for Raw Image Extension, update to fixed build 2.4.36.0 or later; update to fixed build 2.5.35.0 or later.