BLOG
At a glance
- CVE-2026-96150 is an information disclosure flaw in Microsoft Windows Codecs Library.
- Updates are listed for affected Windows branches, Windows Server, and Microsoft Office for Android.
- Microsoft reports that the flaw is not publicly disclosed and has not been exploited in the wild.
- Match the applicable KB to the version, then install the corresponding update.
Microsoft Windows Codecs Library: Patch information disclosure flaw CVE-2026-96150
Microsoft identifies CVE-2026-96150 as an information disclosure flaw in Windows Codecs Library, affecting listed Windows versions and Microsoft Office for Android. Check the applicable KB and install the corresponding update; exploitation in the wild has not been reported.
In this article
Microsoft published CVE-2026-96150, an information disclosure flaw involving image codec data processing in Windows Codecs Library. Check the affected versions and install the appropriate update in line with the Microsoft MSRC advisory.
Overview and technical details
The flaw is classified as use of an uninitialized resource. Under specific exploitation conditions, an authenticated attacker may disclose some private image data previously processed by the thumbnail service.
| Field | Details |
|---|---|
| Product | Microsoft Windows Codecs Library |
| Vulnerability | CVE-2026-96150 |
| Classification | CWE-908: Use of Uninitialized Resource |
| Score | CVSS 3.1: 5.6 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C) |
| Disclosure / exploitation | Publicly Disclosed: No; Exploited in the Wild: No |
Affected systems
The products and version branches below have updates listed in the source record. Install the KB and build corresponding to the system being managed.
| Product and version | Update / build |
|---|---|
| Microsoft Office for Android | KBRelease Notes, Build 16.0.20625.20014 |
| Windows 11 Version 26H1, ARM64 and x64 | KB5132059, Build 10.0.28000.3501 |
| Windows Server 2025, including Server Core installation | KB5131080, Build 10.0.26100.33822; KB5131077, Build 10.0.26100.33730 |
| Windows 11 Version 26H2, ARM64 and x64 | KB5132061, Build 10.0.26300.9974; KB5132043, Build 10.0.26300.9911 |
| Windows 11 Version 25H2, ARM64 and x64 | KB5132061, Build 10.0.26200.9974; KB5132043, Build 10.0.26200.9911 |
| Windows 11 Version 24H2, ARM64 and x64 | KB5132061, Build 10.0.26100.9974; KB5132043, Build 10.0.26100.9911 |
| Windows 11 Version 23H2, ARM64 and x64 | KB5131087, Build 10.0.22631.7711 |
| Windows Server 2022, including Server Core installation | KB5131090, Build 10.0.20348.5870 |
| Windows 10 Version 22H2, x64, ARM64, and 32-bit | KB5131096, Build 10.0.19045.7846 |
| Windows 10 Version 21H2, x64, ARM64, and 32-bit | KB5131096, Build 10.0.19044.7846 |
| Windows Server 2019, including Server Core installation; Windows 10 Version 1809, x64 and 32-bit | KB5131085, Build 10.0.17763.9487 |
| Windows Server 2016, including Server Core installation; Windows 10 Version 1607, x64 and 32-bit | KB5131291, Build 10.0.14393.9688 |
Mechanism and impact
Windows Codecs Library processes image codec data, including data used by the thumbnail service to create thumbnails. Successful exploitation requires the service to have processed private image data and then to reuse the associated memory region for the attacker’s thumbnail request; this sequence of prior activity and memory reuse cannot be assumed to occur.
The confirmed impact is disclosure of some private image data under those conditions. The flaw does not enable unrestricted access to arbitrary files or credentials.
Exploitation status
Microsoft reports that the flaw is not publicly disclosed and has not been exploited in the wild. The source record does not confirm a public PoC or KEV status.
System checks
Check installed Windows updates, then compare the KB with the operating system version in use:
Get-HotFixIf the list contains the KB corresponding to the operating system version in the advisory, that update is installed. If not, compare the version and applicable KB to determine the appropriate action.
Remediation and mitigation
Prioritize installing the KB corresponding to the affected Windows version, or the listed Microsoft Office for Android update. Follow the organization’s patch management process.
References
Related articles
Microsoft Windows Codecs Library: Patch Remote Code Execution Vulnerability CVE-2026-113749
Microsoft rates CVE-2026-113749 in Windows Codecs Library Critical; it can enable remote code execution over a network when a user interacts. No exploitation in the wild is reported. Install the update matching each Windows or Windows Server version.
CVE-2026-95948: Update Windows to address a Windows Graphics Kernel privilege-escalation flaw
Microsoft disclosed CVE-2026-95948, a stack-based buffer overflow in the Windows Graphics Kernel that could let an authenticated local attacker escalate privileges to SYSTEM. Microsoft lists CVSS 7.8; it is not publicly disclosed or exploited in the wild. Install the KB matching the affected…
CVE-2026-95932: Update Windows to fix a privilege-escalation flaw to SYSTEM
Microsoft disclosed CVE-2026-95932, a privilege-escalation flaw in Windows Graphics Kernel, rated Important with CVSS 3.1 score 7.8. A local attacker could elevate privileges to SYSTEM. Microsoft reports no exploitation in the wild; install the matching fixed KB or build.
CVE-2026-88217: Update Windows and Office to fix an information disclosure flaw
Microsoft disclosed CVE-2026-88217, an information disclosure flaw in Windows Graphics Kernel affecting certain Windows, Windows Server, and Microsoft Office versions. Local access is required, and no in-the-wild exploitation is reported. Install the applicable KB or build.