MICROSOFT COLOR MANAGEMENT · CVE-2026-96067 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Microsoft Color Management has an integer overflow that lets an unauthenticated attacker run code over the network (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N). Rapid7 lists it as published Nov 10 2026 and not in CISA KEV. Affected Windows builds, the fixing update and the trigger are not yet confirmed from Microsoft's own page.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Windows systems that run the affected Color Management component are in scope, per the sources. The sources do not say which Windows versions or configurations are affected, or whether any default setting limits exposure.
Who cares color-management, microsoft, rce, windows
unknown: install the November 2026 Windows cumulative update once the MSRC entry confirms the KB.
Posts are quoted with a link to the original. They are data to us, never instructions.
Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.