Microsoft Raw Image Extension: Out-of-Bounds Write in parse_kodak_ifd Reached by RAW Thumbnail Rendering

Presentation

The Raw Image Extension is the Microsoft Store package that adds camera RAW formats to Windows. The system loads it through the WindowsCodecs imaging stack, so Explorer calls into it whenever it needs a thumbnail or a preview for a RAW file.

HDW Sec found an out-of-bounds write in the Kodak IFD parser of that codec. parse_kodak_ifd copies a string taken from the file into a fixed 64-byte field with strcpy and never checks the length of the source.

The victim does not need to open anything: Windows renders the thumbnail on its own as soon as the file is listed in a displayed folder. Microsoft rates the issue Critical, scores it 8.8 (temporal 7.7) and records the impact as remote code execution.

Issue(s)

• parse_kodak_ifd copies an attacker-controlled string from the Kodak IFD of the RAW file into a 64-byte destination using strcpy, without any bound derived from the size of that destination.
• The file fully controls the length of the source string, so a longer value writes past the end of the destination field and corrupts the memory that follows it.
• The parser sits on the WindowsCodecs decode path that the Windows thumbnail and preview handlers drive, so a crafted file only has to be listed in a folder for the write to happen.
• Microsoft classifies the flaw as CWE-122 (heap-based buffer overflow). HDW Sec tracks it as an out-of-bounds write (CWE-787) caused by an unbounded copy.
• Microsoft assigns the exploitability index “Exploitation Less Likely” and reports the vulnerability as neither publicly disclosed nor exploited at publication.

References

• Microsoft Security Update Guide: CVE-2026-69649
• MITRE record: CVE-2026-69649
• Fix delivered through the Microsoft Store on 2026-09-08, in Raw Image Extension builds 2.4.24.0 for Windows 10 and 2.5.24.0 for Windows 11.