MicrosoftCVE-2026-70351

Microsoft WebP Image Extension: integer overflow

High8.8CVE-2026-70351 · Published Sep 8, 2026 · updated Sep 9, 2026

Integer overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code over a network.

Microsoft advisory

Affected versions

Package	Affected	Fixed in
WebP Image Extension Product	>= 1.0.0.0, < 1.2.31.0	1.2.31.0

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-122, CWE-190

More Microsoft advisories

Date	Advisory	Severity	Fixed in
Sep 8	Microsoft Skype for Business: spoofing High8.3Sep 8 CVE-2026-696466.0.9319.885+2 more	High8.3	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: cross-site scripting Medium6.5Sep 8 CVE-2026-696426.0.9319.885+2 more	Medium6.5	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: spoofing High7.1Sep 8 CVE-2026-663056.0.9319.885+2 more	High7.1	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: information disclosure Medium6.5Sep 8 CVE-2026-663066.0.9319.885+2 more	Medium6.5	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: integer overflow High7.5Sep 8 CVE-2026-663076.0.9319.885+2 more	High7.5	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: out-of-bounds read Medium6.5Sep 8 CVE-2026-663086.0.9319.885+2 more	Medium6.5	6.0.9319.885+2 more

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.