Microsoft Windows Raw Image Extension < 2.4.36.0 / 2.5.35.0 RCE (October 2026)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(366090);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/16");

  script_cve_id("CVE-2026-21413", "CVE-2026-96202", "CVE-2026-96943");

  script_name(english:"Microsoft Windows Raw Image Extension < 2.4.36.0 / 2.5.35.0 RCE (October 2026)");

  script_set_attribute(attribute:"synopsis", value:
"The Windows app installed on the remote host is affected by multiple remote code execution vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The Windows 'Raw Image Extension' app installed on the remote host is prior to 2.4.36.0 (2.5.35.0 on Windows 11
versions 21H2 and 26H2). It is, therefore, affected by multiple remote code execution vulnerabilities:

  - A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw.
    A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a malicious
    file to trigger this vulnerability. (CVE-2026-21413)

  - A heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute
    code over a network. (CVE-2026-96202)

  - An integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to
    execute code over a network. (CVE-2026-96943)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported
version number.");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21413");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96202");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96943");
  script_set_attribute(attribute:"solution", value:
"Upgrade the Windows 'Raw Image Extension' app to version 2.4.36.0 (2.5.35.0 on Windows 11 versions 21H2 and
26H2) or later via the Microsoft Store.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-96943");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:raw_image_extension");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("smb_hotfixes.nasl", "wmi_enum_windows_app_store.nbin");
  script_require_keys("SMB/Registry/Enumerated", "WMI/Windows App Store/Enumerated");
  script_require_ports(139, 445);

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app = 'Microsoft.RawImageExtension';

var app_info = vcf::microsoft_appstore::get_app_info(app:app);

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, app);

vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  { 'fixed_version' : '2.4.36.0' },
  { 'min_version' : '2.5', 'fixed_version' : '2.5.35.0' }
];

vcf::microsoft_appstore::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);