{"id":"CVE-2026-96078","kind":"vulnerability","aliases":["CVE-2026-96078"],"related":[],"title":"Microsoft Color Management: heap overflow lets network attacker run code","description":"Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code over a network.","summary":"Microsoft's CVE record (CVSS 9.8, network, no authentication, no user interaction) describes a heap-based buffer overflow in Microsoft Color Management that allows code execution. No Microsoft advisory text was readable, so the affected Windows builds, the fixing update and whether the component is reachable by default over the network are unknown.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Color Management","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","microsoft-color-management","windows"],"not_affected_if":[],"how_to_check":"unknown: Microsoft's advisory was not readable. Check the MSRC Security Update Guide entry for CVE-2026-96078 for the affected Windows builds and KB, then compare with the installed build (winver or Get-ComputerInfo).","fix":null,"status":"open","published_at":"2026-11-10T19:22:06+00:00","first_seen_at":"2026-11-10T19:25:30+00:00","triaged_at":"2026-11-10T19:27:36+00:00","updated_at":"2026-11-10T19:29:06+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-10T19:27:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Color Management: heap overflow lets network attacker run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft Color Management lets an unauthorized attacker reach code execution over a network. The sources do not describe the trigger or the affected Windows builds.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["windows","microsoft-color-management"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the machine over the network","analyst_note":"Find Microsoft's advisory for CVE-2026-96078 for affected Windows builds, the fixed update, and whether the component is reachable by default over the network.","how_to_check":"- unknown","plain_action":"Install Microsoft's security update for Windows as soon as it is available, since the sources do not yet name a fixed build.","product_name":"Microsoft Color Management","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000662,"input_tokens":4495,"output_tokens":425,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Microsoft's advisory for CVE-2026-96078 for affected Windows builds, the fixed update, and whether the component is reachable by default over the network.","search":"'-2026':12A,15A '-96078':13A,16A '9.8':31B 'advisori':55B 'affect':61B 'allow':50B,89C 'attack':8A,92C 'authent':34B 'base':42B,82C 'buffer':43B,83C 'build':63B 'code':10A,51B,95C 'color':2A,18A,23B,47B,87C 'compon':70B 'cve':11A,14A,28B 'cvss':30B 'default':74B 'describ':38B 'execut':52B,94C 'fix':65B 'heap':4A,41B,81C 'heap-bas':40B,80C 'infrastructur':20B 'interact':37B 'let':6A 'manag':3A,24B,48B,88C 'management':19A 'microsoft':1A,17A,22B,26B,46B,54B,86C 'microsoft-color-manag':21B 'network':7A,32B,77B,98C 'overflow':5A,44B,84C 'reachabl':72B 'readabl':58B 'record':29B 'run':9A 'text':56B 'unauthor':91C 'unknown':79B 'updat':66B 'user':36B 'whether':68B 'window':25B,62B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":["colormanagement","microsoftcolormanagement"],"ptokens":["color","management","microsoft"],"labels":["critical","infrastructure","microsoftcolormanagement","vendor","windows"],"campaign_type":null,"search_a":"'-2026':12A,15A '-96078':13A,16A 'attack':8A 'code':10A 'color':2A,18A 'cve':11A,14A 'heap':4A 'let':6A 'manag':3A 'management':19A 'microsoft':1A,17A 'network':7A 'overflow':5A 'run':9A","search_b":"'9.8':31B 'advisori':55B 'affect':61B 'allow':50B 'authent':34B 'base':42B 'buffer':43B 'build':63B 'code':51B 'color':23B,47B 'compon':70B 'cve':28B 'cvss':30B 'default':74B 'describ':38B 'execut':52B 'fix':65B 'heap':41B 'heap-bas':40B 'infrastructur':20B 'interact':37B 'manag':24B,48B 'microsoft':22B,26B,46B,54B 'microsoft-color-manag':21B 'network':32B,77B 'overflow':44B 'reachabl':72B 'readabl':58B 'record':29B 'text':56B 'unknown':79B 'updat':66B 'user':36B 'whether':68B 'window':25B,62B","search_c":"'allow':89C 'attack':92C 'base':82C 'buffer':83C 'code':95C 'color':87C 'execut':94C 'heap':81C 'heap-bas':80C 'manag':88C 'microsoft':86C 'network':98C 'overflow':84C 'unauthor':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96078","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96078","severity":null,"published_at":"2026-11-10T19:22:06+00:00","modified_at":"2026-11-10T19:22:06+00:00","first_seen_at":"2026-11-10T19:25:30+00:00","fetched_at":"2026-11-10T19:25:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96078:2509","url":null,"severity":null,"published_at":"2026-11-10T19:29:06+00:00","modified_at":"2026-11-10T19:29:06+00:00","first_seen_at":"2026-11-10T19:29:06+00:00","fetched_at":"2026-11-10T19:29:06+00:00","note":"Could not retrieve Microsoft's MSRC page (JS-only, empty via web-cli) or any other primary source for this CVE; searches return only unrelated ICC/Windows CVEs (e.g. ZDI-26-543 is CVE-2026-54984, not this one). Only NVD record (CVSS 9.8, AV:N/PR:N/UI:N, CNA Microsoft) exists. Affected builds, KB/fix, trigger and default reachability unknown; settle by reading the MSRC update guide entry (try browser-cli) or the next Patch Tuesday review. Nothing verified."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}