Skip to content
OpenAdvisories
Critical MSRC-CVE-2026-69499 1 CVE

Windows Imaging Component Remote Code Execution Vulnerability

Published Sep 8, 2026 · Updated Oct 28, 2026 · Revision 2

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, the attack vector is network (AV:N) and user interaction is required (UI:R). What is the target context of the remote code execution?
This attack requires a user to open a specially crafted file from the attacker to initiate remote code execution.

Security updates
10.0.17763.9245 — https://support.microsoft.com/help/5122876
10.0.20348.5622 — https://support.microsoft.com/help/5122882
10.0.19044.7725 — https://support.microsoft.com/help/5122878
10.0.26100.33438 — https://support.microsoft.com/help/5122871
10.0.26200.9445 — https://support.microsoft.com/help/5124008
10.0.22631.7582 — https://support.microsoft.com/help/5122880
10.0.28000.2954 — https://support.microsoft.com/help/5124012
10.0.14393.9512 — https://support.microsoft.com/help/5123099
6.2.9200.26349 — https://support.microsoft.com/help/5123065
6.3.9600.23398 — https://support.microsoft.com/help/5123066
16.0.20430.20000 — https://support.microsoft.com/en-us/microsoft-365
16.112.26090911 — https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac

Vulnerabilities 1

Revision history

  1. #2

    Added supported editions of Microsoft Office to the Security Updates table because they are affected by this vulnerability. Microsoft recommends that customers running any of these editions of Office install the latest security updates to be fully protected from this vulnerability.

  2. #1

    Information published.

References