{"id":"CVE-2026-96067","kind":"vulnerability","aliases":["CVE-2026-96067"],"related":[],"title":"Windows: integer overflow in Color Management lets remote attackers run code","description":"Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network.","summary":"Microsoft Color Management has an integer overflow that lets an unauthenticated attacker run code over the network (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N). Rapid7 lists it as published Nov 10 2026 and not in CISA KEV. Affected Windows builds, the fixing update and the trigger are not yet confirmed from Microsoft's own page.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Color Management","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["color-management","infrastructure","microsoft","rce","windows"],"not_affected_if":[],"how_to_check":"unknown: Microsoft's advisory was not readable. Check the Security Update Guide entry for CVE-2026-96067 for the KB per Windows version, then confirm that KB is installed (Settings > Windows Update > Update history).","fix":"unknown: install the November 2026 Windows cumulative update once the MSRC entry confirms the KB.","status":"open","published_at":"2026-11-10T19:22:04+00:00","first_seen_at":"2026-11-10T19:25:29+00:00","triaged_at":"2026-11-10T19:27:37+00:00","updated_at":"2026-11-10T19:29:13+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:27:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows: integer overflow in Color Management lets remote attackers run code","impact":"high","summary":"Microsoft Color Management has an integer overflow that lets an unauthorized attacker run code on an affected Windows system over the network. The sources give a CVSS score of 9.8 and do not describe the exact trigger.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code remotely on the affected Windows machine","analyst_note":"Confirm affected Windows builds and the Microsoft update that fixes CVE-2026-96067 via the NVD entry and Microsoft's security update guide.","how_to_check":"- unknown","plain_action":"Install the latest Windows security update from Microsoft and keep automatic updates on.","product_name":"Microsoft Color Management","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows systems that run the affected Color Management component are in scope, per the sources. The sources do not say which Windows versions or configurations are affected, or whether any default setting limits exposure.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000687,"input_tokens":4495,"output_tokens":475,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm affected Windows builds and the Microsoft update that fixes CVE-2026-96067 via the NVD entry and Microsoft's security update guide.","search":"'-2026':13A,16A '-96067':14A,17A '10':59B '2026':60B '3.1':46B '9.8':47B 'affect':66B 'allow':92C 'attack':9A,39B,95C 'av':48B 'build':68B 'cisa':64B 'code':11A,41B,98C 'color':5A,19A,22B,29B,90C 'color-manag':21B 'confirm':78B 'cve':12A,15A 'cvss':45B 'execut':97C 'fix':70B 'infrastructur':24B 'integ':2A,33B,84C 'kev':65B 'l/pr':50B 'let':7A,36B 'list':54B 'manag':6A,23B,30B,91C 'management':20A 'microsoft':18A,25B,28B,80B,89C 'n':52B 'n/ac':49B 'n/ui':51B 'network':44B,101C 'nov':58B 'overflow':3A,34B,85C 'page':83B 'publish':57B 'rapid7':53B 'rce':26B 'remot':8A 'run':10A,40B 'trigger':74B 'unauthent':38B 'unauthor':94C 'updat':71B 'window':1A,27B,67B 'wraparound':87C 'yet':77B","nicknames":[],"mitigations":[],"who_affected":"Windows systems that run the affected Color Management component are in scope, per the sources. The sources do not say which Windows versions or configurations are affected, or whether any default setting limits exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":["colormanagement","microsoftcolormanagement"],"ptokens":["color","management","microsoft"],"labels":["colormanagement","critical","infrastructure","microsoft","rce","vendor","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96067':14A,17A 'attack':9A 'code':11A 'color':5A,19A 'cve':12A,15A 'integ':2A 'let':7A 'manag':6A 'management':20A 'microsoft':18A 'overflow':3A 'remot':8A 'run':10A 'window':1A","search_b":"'10':59B '2026':60B '3.1':46B '9.8':47B 'affect':66B 'attack':39B 'av':48B 'build':68B 'cisa':64B 'code':41B 'color':22B,29B 'color-manag':21B 'confirm':78B 'cvss':45B 'fix':70B 'infrastructur':24B 'integ':33B 'kev':65B 'l/pr':50B 'let':36B 'list':54B 'manag':23B,30B 'microsoft':25B,28B,80B 'n':52B 'n/ac':49B 'n/ui':51B 'network':44B 'nov':58B 'overflow':34B 'page':83B 'publish':57B 'rapid7':53B 'rce':26B 'run':40B 'trigger':74B 'unauthent':38B 'updat':71B 'window':27B,67B 'yet':77B","search_c":"'allow':92C 'attack':95C 'code':98C 'color':90C 'execut':97C 'integ':84C 'manag':91C 'microsoft':89C 'network':101C 'overflow':85C 'unauthor':94C 'wraparound':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96067","severity":null,"published_at":"2026-11-10T19:22:04+00:00","modified_at":"2026-11-10T19:22:04+00:00","first_seen_at":"2026-11-10T19:25:29+00:00","fetched_at":"2026-11-10T19:25:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96067:2510","url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-96067/","severity":null,"published_at":"2026-11-10T19:29:13+00:00","modified_at":"2026-11-10T19:29:13+00:00","first_seen_at":"2026-11-10T19:29:13+00:00","fetched_at":"2026-11-10T19:29:13+00:00","note":"Only Rapid7 (published Nov 10 2026, CVSS 3.1 9.8 AV:N/PR:N/UI:N) readable; NVD and MSRC pages returned empty. Affected builds, KB and fix unconfirmed; not in KEV per Rapid7. Likely in Nov 2026 Patch Tuesday (BleepingComputer, 1,235 flaws) but I did not see this CVE listed there. Settle by reading the MSRC guide entry.","cites":["https://www.rapid7.com/db/vulnerabilities/cve-2026-96067/"]}],"documents":[{"id":117533,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-96067/","title":"Rapid7: CVE-2026-96067 Microsoft Color Management integer overflow","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}