CVE-2026-73023

Think of the Windows Imaging Component as a routine that handles certain imaging-related data. This flaw is like a “crumpled instruction” that, when processed over the network, can make Windows behave incorrectly and allow an attacker to run their own code—similar to someone tricking a computer into executing unsafe steps instead of handling the data normally.

This matters if you use or manage any of these operating systems: Windows 10, Windows 11, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, or Windows Server 2025. The vulnerability is designed to be triggered remotely from the network, without needing an attacker to be logged in. Act on it if the affected machine is reachable from other networks (for example, your internal network or the internet) and network services using this component are exposed.

This should be treated as urgent because the flaw is a remote code execution issue in a core Windows component and can let an attacker run code from the network. Even though there is no KEV listing and no public exploit code on record, you still have fixed versions available for multiple Windows releases, so patching is the right immediate step.