CVE-2026-96067

Summary

An integer overflow vulnerability in Microsoft Color Management (CWE-190) allows an unauthenticated remote attacker to trigger memory corruption over the network, potentially leading to arbitrary code execution. The flaw is exploitable without user interaction or prior access.

Exploitability

Exploitation requires network access to a vulnerable system with Microsoft Color Management functionality exposed; no authentication or user interaction is needed, but successful exploitation likely depends on precise memory conditions that may require multiple attempts or additional information about the target environment.

Blast radius

If exploited, this vulnerability could allow full system compromise—including confidentiality, integrity, and availability impacts—on any affected system without lateral movement, making it highly dangerous for exposed services.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

No fixed version or patch level is specified in the published description; Microsoft has not released a fix as of the CVE record date. As an immediate control, disable or restrict access to the affected Color Management network-exposed interfaces per vendor guidance, and monitor for unauthorized use of color management APIs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.