MSRC-CVE-2026-100204 — HEIF Image Extensions Remote Code Execution Vulnerability

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to have a deep understanding of the system. Successful exploitation is not guaranteed and depends on a combination of factors that might include the environment, system configuration, and the presence of additional security measures.

Vulnerabilities 1

High 7.0

CVE-2026-100204 Public exploit

HEIF Image Extensions Remote Code Execution Vulnerability

Use after free in HEIF Image Extensions allows an unauthorized attacker to execute code locally.

Microsoft HEIF Image Extension

Nov 10, 2026

Revision history

2026-11-10 #1
Information published.

References

CVE-2026-100204 HEIF Image Extensions Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100204
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss