CVE-2026-100204ImportantRCELocal

HEIF Image Extensions Remote Code Execution Vulnerability

MSRC advisory NVD CVE.org

Assessment

Use after free in HEIF Image Extensions allows an unauthorized attacker to execute code locally.

Severity: Important
CVSS base score: 7.0
Impact: Remote Code Execution
Exploitation detected: No known exploitation (MSRC assessment)
Exploitability: Exploitation Less Likely
Publicly disclosed: No (MSRC assessment)
EPSS · 30-day forecast: No EPSS score collected
Customer action: Required: follow the MSRC remediation guidance

More details

CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Public detection template: No Nuclei template is listed in the current collected catalog
Component: HEIF Image Extensions
Weakness: CWE-416: Use After Free
Issued by: Microsoft
Published: 10 Nov 2026 · November 2026
Last revised: 10 Nov 2026

CVSS 3.1 base metricsRed raises the risk · green lowers it

Attack vector: LocalAV:L
Attack complexity: HighAC:H
Privileges required: NonePR:N
User interaction: RequiredUI:R
Scope: UnchangedS:U
Confidentiality: HighC:H
Integrity: HighI:H
Availability: HighA:H

Updates that fix it

0 KBs

No KB listed

No KB update is listed in the collected MSRC record. Check the MSRC advisory for product releases and other remedies.

Affected products

Windows

8 affected products

HEIF Image Extension on Windows 10 version 1809
HEIF Image Extension on Windows 10 version 21H2
HEIF Image Extension on Windows 10 version 22H2
HEIF Image Extension on Windows 11 version 23H2
HEIF Image Extension on Windows 11 version 24H2
HEIF Image Extension on Windows 11 version 25H2
HEIF Image Extension on Windows 11 version 26H1
HEIF Image Extension on Windows 11 version 26H2

Page history

Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.

Cite this version

Field-level log (0)

Up to 100 recent field edits are shown; older edits may be outside retention.

No retained field changes for this selection.

Explore global source statements, affected packages and advisory history for CVE-2026-100204. The catalog has a separate collection scope from Microsoft release records.

cve-program · CVE-2026-100204

Published

HEIF Image Extension

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "HEIF Image Extension",
                    "platforms": [
                        "Windows 10 version 1809",
                        "Windows 10 version 21H2",
                        "Windows 10 version 22H2",
                        "Windows 11 version 23H2",
                        "Windows 11 version 24H2",
                        "Windows 11 version 25H2",
                        "Windows 11 version 26H1",
                        "Windows 11 version 26H2"
                    ],
                    "versions": [
                        {
                            "version": "1.0.0.0",
                            "lessThan": "1.2.62.0",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON