CVE-2026-85842
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
Risk Assessment
An attacker with valid credentials could exploit this vulnerability to elevate privileges, posing a risk of system compromise.
Recommendation
Promptly install the latest security updates for Windows.
Other vulnerabilities in Windows Image Acquisition
See all- CVE-2026-85930High
Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
- CVE-2026-83523High
Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to execute code over a network.
- CVE-2026-69613High
Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
- CVE-2026-69500High
Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
- CVE-2026-69341High
Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
- CVE-2026-50315High
The Windows Image Acquisition component contains a null pointer dereference vulnerability that allows an authorized attacker to elevate privileges locally.
- CVE-2023-35342High
A vulnerability in Windows Image Acquisition allows for elevation of privilege, potentially leading to unauthorized access to the system.
Original NVD description (English source)
Use of externally-controlled format string in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS