Use After Free in Microsoft Heif Image Extension
CVE-2026-100204
Use after free in HEIF Image Extensions allows an unauthorized attacker to execute code locally.
Vulnerability class: Use-After-Free
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
FIRST.org has not scored this CVE yet. About EPSS.
Affected products
Weakness classification (CWE)
Public exploits and proof-of-concept code
1 public repository with exploit or proof-of-concept code for this CVE:
- OntologicallyGood/property-damage (last pushed 2026-11-08): CVE-2026-100204
References
- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100204 (vendor-advisory, patch)
This CVE has public exploit evidence. See the latest CVEs with public exploits.