CVE-2026-96078

Summary

A heap-based buffer overflow (CWE-122) with integer overflow (CWE-191) exists in Microsoft Color Management, allowing remote code execution without authentication over the network. The vulnerability enables an unauthenticated attacker to corrupt memory and potentially execute arbitrary code on affected systems.

Exploitability

Exploitation is highly likely due to network accessibility, low attack complexity, and no required privileges or user interaction.

Blast radius

Successful exploitation could lead to full system compromise including data theft, malware deployment, or lateral movement across the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

No fixed version or patch level is specified in the published description; disable Microsoft Color Management functionality or restrict network access to affected services pending vendor guidance.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.