Fixed in this Patch Tuesday, two vulnerabilities we reported to Microsoft:
Raw Image Extension Remote Code Execution Vulnerability (CVE-2026-69649), CVSS 8.8, rated Critical
HEVC Video Extensions Remote Code Execution Vulnerability (CVE-2026-58599), CVSS 7.8, rated Critical
Both are zero-click. The victim clicks on nothing. Windows calls these codecs by itself as soon as Explorer has to produce a thumbnail or a preview, so displaying a folder is enough for the attacker's file to be parsed. A network share, a saved attachment or a downloads folder will do.
https://t.co/ISm20fwxOU
https://t.co/DksByWku3K
All the vulnerabilities we have published are listed here: https://t.co/4FDXDVkPsR
#ZeroClick #PatchTuesday #Windows
Patch-diffing CVE-2026-50313 in Windows NTFS.
Found the OOB read in "NtfsQueryEaSimpleScan", reachable from an unprivileged process and usable as a kernel memory disclosure primitive.
Writeup:
https://t.co/BsZgPATxde
Patch-diffing CVE-2026-50313 in Windows NTFS.
Found the OOB read in "NtfsQueryEaSimpleScan", reachable from an unprivileged process and usable as a kernel memory disclosure primitive.
Writeup:
https://t.co/BsZgPATxde