{"id":"CVE-2026-96054","kind":"vulnerability","aliases":["CVE-2026-96054"],"related":[],"title":"Windows Color Management: heap overflow lets a local attacker run code (needs user interaction)","description":"Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code locally.","summary":"Microsoft's CVE record (published 2026-11-10) describes a heap-based buffer overflow (CWE-122, with an integer overflow, CWE-190) in Microsoft Color Management that lets an unauthorized attacker execute code locally. Microsoft titles it Remote Code Execution, but the CVSS 3.1 vector is 7.0 High: local, high complexity, no privileges, user interaction required. Exploit maturity is marked Unproven and an official fix is available. I did not find a public proof of concept or exploitation.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Color Management","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 10/11 and Windows Server (Color Management)","fixed":["10.0.14393.9688","10.0.17763.9487","10.0.19044.7846","10.0.19045.7846","10.0.22631.7711","10.0.26100.9974","10.0.26200.9974","10.0.28000.3501","10.0.26300.9974","10.0.20348.5870","10.0.26100.33822"],"affected":"Win10 1607 < 10.0.14393.9688; 1809 < 10.0.17763.9487; 21H2 < 10.0.19044.7846; 22H2 < 10.0.19045.7846; Win11 23H2 < 10.0.22631.7711; 24H2 < 10.0.26100.9974; 25H2 < 10.0.26200.9974; 26H1 < 10.0.28000.3501; 26H2 < 10.0.26300.9974; Server 2022 < 10.0.20348.5870; Server 2025 < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["local","microsoft-color-management","other","patch-available","windows"],"not_affected_if":[],"how_to_check":"Run winver or [System.Environment]::OSVersion in PowerShell and compare the build number with the fixed builds listed in the fix field. Any lower build in the same Windows line is exposed. The KB article numbers are on the MSRC page (CVE-2026-96054), which needs JavaScript, so I could not read them.","fix":"Install the November 2026 Windows security update. Fixed builds per Microsoft's CVE record: Win10 1607/Server 2016 10.0.14393.9688; Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Server 2022 10.0.20348.5870; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2025 10.0.26100.33822.","status":"open","published_at":"2026-11-10T19:22:02+00:00","first_seen_at":"2026-11-10T19:25:28+00:00","triaged_at":"2026-11-10T19:49:25+00:00","updated_at":"2026-11-10T20:00:34+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-10T19:49:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Microsoft Color Management: heap overflow lets a local attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft Color Management lets an unauthorized attacker run code on the affected machine. The attacker must already have access to the machine, since the flaw is reachable only locally.","audience":"businesses","category":"other","nicknames":[],"who_cares":["windows","microsoft-color-management"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"code runs on the local machine with attacker-chosen privileges","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-96054 for affected Windows builds, required privileges and the patch.","how_to_check":"unknown","plain_action":"","product_name":"Microsoft Color Management","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000644,"input_tokens":4492,"output_tokens":389,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-96054 for affected Windows builds, required privileges and the patch.","search":"'-10':48B '-11':47B '-122':57B '-190':63B '-2026':16A,19A '-96054':17A,20A '10/11':25A '2026':46B '3.1':85B '7.0':88B 'allow':129C 'and':26A 'attack':9A,72B,132C 'avail':39B,108B 'base':53B,122C 'buffer':54B,123C 'code':11A,74B,80B,135C 'color':2A,22A,29A,34B,66B,127C 'complex':92B 'concept':117B 'cve':15A,18A,43B 'cvss':84B 'cwe':56B,62B 'describ':49B 'execut':73B,81B,134C 'exploit':98B,119B 'find':112B 'fix':106B 'heap':4A,52B,121C 'heap-bas':51B,120C 'high':89B,91B 'integ':60B 'interact':14A,96B 'let':6A,69B 'local':8A,31B,75B,90B,136C 'manag':3A,35B,67B,128C 'management':23A,30A 'mark':101B 'matur':99B 'microsoft':21A,33B,41B,65B,76B,126C 'microsoft-color-manag':32B 'need':12A 'offici':105B 'overflow':5A,55B,61B,124C 'patch':38B 'patch-avail':37B 'privileg':94B 'proof':115B 'public':114B 'publish':45B 'record':44B 'remot':79B 'requir':97B 'run':10A 'server':28A 'titl':77B 'unauthor':71B,131C 'unproven':102B 'user':13A,95B 'vector':86B 'window':1A,40B 'windows':24A,27A","nicknames":[],"mitigations":[],"who_affected":"Windows PCs and servers on a build below the fixed ones for their release (Windows 10 1607 to 22H2, Windows 11 23H2 to 26H2, Server 2016, 2019, 2022 and 2025). The attacker needs local access, and the CVSS vector says a user has to take an action. Fully patched machines can skip it. Shared machines, terminal servers and workstations that handle files from outside deserve the update first.","tier":"B","verified":{"products":{"at":"2026-11-10T20:00:34Z","by":"analyst","doc":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96054","run_id":2590},"who_affected":{"at":"2026-11-10T20:00:34Z","by":"analyst","doc":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96054","run_id":2590}},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Install the latest Windows updates: Settings > Windows Update > Check for updates, then restart.","pkeys":["1011andwindowsservercolormanagement","colormanagement","microsoftcolormanagement","windows1011andwindowsservercolormanagement"],"ptokens":["10","11","and","color","management","microsoft","server","windows"],"labels":["high","local","microsoftcolormanagement","other","patchavailable","vendor","windows"],"campaign_type":null,"search_a":"'-2026':16A,19A '-96054':17A,20A '10/11':25A 'and':26A 'attack':9A 'code':11A 'color':2A,22A,29A 'cve':15A,18A 'heap':4A 'interact':14A 'let':6A 'local':8A 'manag':3A 'management':23A,30A 'microsoft':21A 'need':12A 'overflow':5A 'run':10A 'server':28A 'user':13A 'window':1A 'windows':24A,27A","search_b":"'-10':48B '-11':47B '-122':57B '-190':63B '2026':46B '3.1':85B '7.0':88B 'attack':72B 'avail':39B,108B 'base':53B 'buffer':54B 'code':74B,80B 'color':34B,66B 'complex':92B 'concept':117B 'cve':43B 'cvss':84B 'cwe':56B,62B 'describ':49B 'execut':73B,81B 'exploit':98B,119B 'find':112B 'fix':106B 'heap':52B 'heap-bas':51B 'high':89B,91B 'integ':60B 'interact':96B 'let':69B 'local':31B,75B,90B 'manag':35B,67B 'mark':101B 'matur':99B 'microsoft':33B,41B,65B,76B 'microsoft-color-manag':32B 'offici':105B 'overflow':55B,61B 'patch':38B 'patch-avail':37B 'privileg':94B 'proof':115B 'public':114B 'publish':45B 'record':44B 'remot':79B 'requir':97B 'titl':77B 'unauthor':71B 'unproven':102B 'user':95B 'vector':86B 'window':40B","search_c":"'allow':129C 'attack':132C 'base':122C 'buffer':123C 'code':135C 'color':127C 'execut':134C 'heap':121C 'heap-bas':120C 'local':136C 'manag':128C 'microsoft':126C 'overflow':124C 'unauthor':131C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96054","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96054","severity":null,"published_at":"2026-11-10T19:22:02+00:00","modified_at":"2026-11-10T19:22:02+00:00","first_seen_at":"2026-11-10T19:25:28+00:00","fetched_at":"2026-11-10T19:25:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96054:2590","url":"https://cveawg.mitre.org/api/cve/CVE-2026-96054","severity":null,"published_at":"2026-11-10T20:00:34+00:00","modified_at":"2026-11-10T20:00:34+00:00","first_seen_at":"2026-11-10T20:00:34+00:00","fetched_at":"2026-11-10T20:00:34+00:00","note":"Read Microsoft's CNA CVE record (MSRC page is JS-only, KBs not read). Builds from the record; no PoC or exploitation found; no social search done.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-96054","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96054"]}],"documents":[{"id":117724,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-96054","title":"CVE-2026-96054 record published by Microsoft (CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":117725,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96054","title":"MSRC Security Update Guide: CVE-2026-96054 (page needs JavaScript)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}