---
id: "CVE-2026-96078"
page: "https://infrastack.ai/live/CVE-2026-96078"
kind: "vulnerability"
aliases: ["CVE-2026-96078"]
title: "Microsoft Color Management: heap overflow lets network attacker run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Color Management", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "microsoft-color-management", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:22:06+00:00"
first_seen_at: "2026-11-10T19:25:30+00:00"
updated_at: "2026-11-10T19:29:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96078", "first_seen_at": "2026-11-10T19:25:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T19:29:06+00:00"}]
exploit_sources: []
---

# Microsoft Color Management: heap overflow lets network attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-96078 (this .md is for agents)

Microsoft's CVE record (CVSS 9.8, network, no authentication, no user interaction) describes a heap-based buffer overflow in Microsoft Color Management that allows code execution. No Microsoft advisory text was readable, so the affected Windows builds, the fixing update and whether the component is reachable by default over the network are unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Color Management affected range not listed fixed no fixed version listed

## How to check

unknown: Microsoft's advisory was not readable. Check the MSRC Security Update Guide entry for CVE-2026-96078 for the affected Windows builds and KB, then compare with the installed build (winver or Get-ComputerInfo).

## Timeline

- 2026-11-10T19:25:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96078
- 2026-11-10T19:29:06+00:00 analyst — Could not retrieve Microsoft's MSRC page (JS-only, empty via web-cli) or any other primary source for this CVE; searches return only unrelated ICC/Windows CVEs (e.g. ZDI-26-543 is CVE-2026-54984, not this one). Only NVD record (CVSS 9.8, AV:N/PR:N/UI:N, CNA Microsoft) exists. Affected builds, KB/fix, trigger and default reachability unknown; settle by reading the MSRC update guide entry (try browser-cli) or the next Patch Tuesday review. Nothing verified.

## From the sources

Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_