Loading vulnerability…
Microsoft Color Management Integer Overflow Remote Code Execution
CVE-2026-96067 is an integer overflow or wraparound vulnerability in Microsoft Color Management. An unauthenticated attacker can trigger the vulnerability over a network by causing a Windows application using the component to process a specially crafted color profile. Successful exploitation executes arbitrary code in the context of that application. The CVSS v3.1 base score is 9.8, with no required privileges or user interaction. Microsoft rates exploitation as less likely and reported no known exploitation at initial publication. Affected versions and the specific vulnerable function are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality, integrity, and availability of the application processing the malicious color profile and resources accessible under its security context. The vulnerability does not establish execution with SYSTEM privileges or a separate privilege-escalation capability.
If you can’t patch tonight, do this now.
No vulnerability-specific interim mitigation or workaround is identified. Consult Microsoft's vulnerability guidance for any applicable workarounds; no substitute for installing the security update is established.
Patch, then assume compromise.
Apply the applicable Microsoft security update for CVE-2026-96067. An official fix is available. Consult the Microsoft Security Response Center Security Update Guide to identify the appropriate update for each installed Windows release and architecture; specific KB identifiers and fixed versions are not available here.
No public exploits tracked yet. Mallory keeps watching.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.