Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-96078 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | Microsoft |
| Product | Color Management |
| Vulnerability Type | heap-based buffer overflow, remote code execution (CWE-122) |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code over a network.
The Color Management component (ICM/WCS) processes color profiles, among other things when displaying and printing images. NVD also lists integer underflow (CWE-191) as a cause. In the same update cycle Microsoft fixed a second critical flaw in this component — CVE-2026-96067.
Required Actions
- Install the November 2026 Windows security updates via Microsoft Update / WSUS / Intune on workstations and servers — prioritize internet-facing systems.
- Check MSRC (linked in Sources) for KB numbers and the list of affected Windows versions.
- Verify that the update actually reached every device, including those outside the domain.
Who Is Affected?
The vulnerability affects Microsoft Windows systems with the Color Management component — workstations and servers. MSRC lists the exact affected Windows versions and KB numbers.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-96078 vulnerability?
CVE-2026-96078 is a heap-based buffer overflow (CWE-122) in Microsoft Color Management that enables remote code execution. CVSS score: 9.8. Microsoft released a fix in the November 2026 security updates.
Does exploiting CVE-2026-96078 require authentication?
According to the vendor's CVSS assessment, the attack is carried out over the network and requires no authentication or user interaction.
How to protect against CVE-2026-96078?
Install the November 2026 Windows security updates (Patch Tuesday) on all workstations and servers.
Who is affected by CVE-2026-96078?
Organizations running Windows systems that include the Color Management component — in practice almost every company.
