CVE-2026-70351: Microsoft WebP Image Extension RCE Vulnerability

CVE-2026-70351 Overview

CVE-2026-70351 is an integer overflow vulnerability in the Microsoft WebP Image Extension that permits remote code execution. An unauthorized attacker can trigger the flaw over a network when a user opens or previews a crafted WebP image. The weakness is classified as [CWE-122] Heap-based Buffer Overflow, which arises when integer wraparound miscalculates allocation sizes. Microsoft published details in the Microsoft Vulnerability Update CVE-2026-70351 advisory.

Critical Impact
Successful exploitation lets a remote attacker execute arbitrary code in the context of the current user, compromising confidentiality, integrity, and availability of the affected system.

Affected Products

Microsoft WebP Image Extension (Windows Store component)
Windows systems with the WebP Image Extension installed
Applications that rely on the WebP Image Extension for image parsing

Discovery Timeline

2026-09-08 - CVE-2026-70351 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-70351

Vulnerability Analysis

The vulnerability resides in the WebP decoding logic of the Microsoft WebP Image Extension. Integer overflow or wraparound occurs while computing buffer sizes for image data. The undersized allocation is then written with attacker-controlled bytes, producing a heap-based buffer overflow classified as [CWE-122]. Successful exploitation enables arbitrary code execution in the process that renders the image.

The attack requires network delivery and user interaction. A victim must open, preview, or otherwise cause an application to decode a crafted .webp file. Common delivery paths include email attachments, chat messages, malicious websites, and file shares that trigger thumbnail generation.

Root Cause

The root cause is unchecked arithmetic during allocation size calculation for WebP image buffers. When width, height, or chunk-length values exceed expected bounds, the computed size wraps to a small value. Subsequent decode operations copy full-sized pixel or chunk data into the undersized heap buffer, corrupting adjacent heap metadata and objects.

Attack Vector

Exploitation occurs over the network with low complexity and no privileges required. The attacker crafts a malformed WebP file with header fields designed to induce integer wraparound in size arithmetic. Delivery mechanisms include phishing emails, malicious web content, and messaging platforms that render inline images. User interaction, such as opening a folder that generates thumbnails, is sufficient to trigger the vulnerable decoder.

See the Microsoft Security Response Center advisory for technical details:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70351

Detection Methods for CVE-2026-70351

Indicators of Compromise

Unexpected crashes or exceptions in processes that load Microsoft.WebpImageExtension or invoke WindowsCodecs.dll when handling .webp files.
Delivery of .webp files from untrusted email, chat, or web sources followed by anomalous child process creation from image viewers or Explorer.
Suspicious outbound network connections initiated by image-rendering or thumbnail-generation processes shortly after WebP file access.

Detection Strategies

Hunt for .webp files written to user Downloads, Temp, and email attachment cache directories, correlated with subsequent process launches from the same user session.
Alert on child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by explorer.exe, Photos.exe, or Office applications immediately after WebP file access.
Inspect crash telemetry for access violations inside WebP decoder modules, which may indicate exploitation attempts or unstable exploit chains.

Monitoring Recommendations

Enable Windows Defender Exploit Guard and Attack Surface Reduction rules that block child process creation from Office and communication clients.
Ingest process, file, and image-load telemetry into a central data lake to correlate WebP file delivery with post-exploitation behavior.
Monitor Microsoft Store update logs to confirm the WebP Image Extension has received the patched version across the fleet.

How to Mitigate CVE-2026-70351

Immediate Actions Required

Apply the Microsoft WebP Image Extension update through the Microsoft Store on all affected Windows endpoints.
Enforce automatic Microsoft Store app updates via group policy or Intune to close the patch window.
Instruct users to avoid opening .webp attachments from untrusted senders until the update is deployed.

Patch Information

Microsoft has released an updated version of the WebP Image Extension. Refer to the Microsoft Vulnerability Update CVE-2026-70351 advisory for the fixed package version and deployment guidance. The update is delivered through the Microsoft Store and applies to systems where the extension is installed.

Workarounds

Uninstall the Microsoft WebP Image Extension on systems that do not require WebP rendering until the patch is applied.
Block .webp attachments at the email gateway and restrict WebP downloads through web proxy content filters.
Disable image previews and thumbnail generation in File Explorer for shared or high-risk directories.

bash

# Verify Microsoft WebP Image Extension version on Windows
Get-AppxPackage -Name Microsoft.WebpImageExtension | Select-Object Name, Version

# Force Microsoft Store to check for updates
Start-Process ms-windows-store://downloadsandupdates