Microsoft November patches fix 1,090 flaws, one Outlook bug exploited
CVE-2026-124194 can leak an NTLMv2 hash if a user opens a crafted Outlook file; ZDI flags 30 wormable bugs.
78
CVE-2026-96067
Unauthenticated network RCE via integer overflow in Microsoft Color Management
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An integer overflow or wraparound in Microsoft Color Management lets an unauthorized attacker execute code over the network. No authentication or user interaction is required. Successful exploitation gives full control of confidentiality, integrity, and availability on the affected system. Microsoft has not listed affected builds or fixed versions.
What to do: Apply Microsoft's update for CVE-2026-96067. No workaround is named.
| Product | Affected |
|---|---|
| Microsoft Color Management | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network.
- Weakness
- CWE-190
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H