Microsoft Color Management: Heap-based buffer overflow enables code execution

Summary

Microsoft Color Management, the Windows component that processes ICC color profiles, contains a heap-based buffer overflow (CWE-122, CWE-190). The NVD description says an unauthorized attacker can execute code locally, while Microsoft's title describes a remote code execution vulnerability; the CVSS vector (AV:L, UI:R) points to local access with user interaction, such as opening a crafted file. Successful exploitation could lead to code execution with high impact on confidentiality, integrity and availability. No public exploit and no in-the-wild exploitation are known for this CVE.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2: builds before 10.0.26100.9974
• Windows 11 Version 25H2: builds before 10.0.26200.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows 11 Version 26H2: builds before 10.0.26300.9974
• Windows Server 2022: builds before 10.0.20348.5870

Fixed in

• Fixed in the November 2026 security update (per the affected ranges in the CNA record, the fixed builds are the ones listed as upper limits above)
• KB numbers: Unknown. Confirm them in the MSRC update guide before rollout

Workaround

• Unknown. No vendor-published workaround was found. Installing the security update is the priority.

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total
• No evidence of exploitation in the wild for this CVE
• No public proof of concept found

Our recommendation

• Install the November 2026 cumulative security update on all affected Windows clients and servers, prioritising multi-user systems such as terminal servers
• Check whether Windows 10 1607, 1809 and 21H2 still receive security updates (for example through ESU); systems without updates cannot be fixed and should be upgraded or isolated
• Verify the exact fixed builds and KB numbers in the MSRC advisory
• Educate users not to open untrusted files or attachments

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  kagancapar/CVE-2026-96054

Research sources

• CVE Record (CNA) www.cve.org
• MSRC Security Update Guide msrc.microsoft.com
• BleepingComputer: November 2026 Patch Tuesday www.bleepingcomputer.com
• Rapid7: Patch Tuesday November 2026 www.rapid7.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:45.