Integer overflow in Microsoft Windows and Windows Server - CVE-2026-96067

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code in the context of an application that uses Microsoft Color Management.

The vulnerability exists due to integer overflow or wraparound in Microsoft Color Management when processing color profiles. A remote attacker can cause an application to process a specially crafted color profile to execute arbitrary code in the context of that application.

Affected software

How to mitigate CVE-2026-96067

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96067
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96067

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows