ZDI-26-543: Microsoft Windows ICC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

CVE-2026-54984 is a heap-based buffer overflow (CWE-122) in the Windows Imaging Component, the core imaging and color-management engine built into Windows. Related advisory coverage (ZDI-26-543) ties the flaw to an out-of-bounds write while parsing ICC color-profile data embedded in image files, meaning a crafted image containing a malicious ICC profile triggers the bug when a user opens, previews, or otherwise processes it. Because the CVSS vector is AV:L with UI:R, exploitation requires user interaction rather than a network-facing service; a successful attacker executes code with the privileges of the local user, with high impact to confidentiality, integrity, and availability. Nearly every supported Windows deployment is affected, since the listed versions span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2022. There is no known public proof of concept, the flaw is not in CISA's KEV, and EPSS puts 30-day exploitation odds at about 0.6%, so no in-the-wild exploitation is known at this time.

Do: Apply Microsoft's security update for CVE-2026-54984 across all affected Windows 10, Windows 11, and Windows Server systems, prioritizing machines and servers that process untrusted images (email attachments, browser downloads, shared folders, thumbnail/print pipelines); older Windows 10 releases and Windows Server 2012 may only receive the fix via extended support channels such as ESU. Until patched, instruct users not to open image files from untrusted sources and review any automated processing of untrusted images with ICC profiles attached. Verify remediation by confirming the relevant Microsoft security update is installed on each affected release rather than relying on a single KB across all versions.