## https://sploitus.com/exploit?id=32F39E10-D3A5-5EDE-956D-8C66FBE8F22F
# CVE-2026-54984
**Windows ICC file parsing out-of-bounds write — remote code execution**
Reported through the Zero Day Initiative as **ZDI-CAN-30441**, published as **ZDI-26-543**, fixed by Microsoft in the August 2026 update cycle.
Hi, I'm [Kağan Çapar](https://github.com/kagancapar). I reported this vulnerability to the Zero Day Initiative, which disclosed it to Microsoft on 2 June 2026. It was fixed and published on 11 August 2026 — the August Patch Tuesday — and I am credited in the ZDI advisory.
> **What this repository is.** A public record of the disclosure: identifiers, scoring, affected builds, patch KBs, and timeline, assembled from the vendor and ZDI advisories. **It contains no proof of concept and no technical analysis.** ZDI acquisition terms grant exclusivity over the technical detail, and the coordinated disclosure covers only what the two advisories state. Please don't open issues asking for a PoC — there won't be one.
| | |
|---|---|
| **CVE** | [CVE-2026-54984](https://vulners.com/cve/CVE-2026-54984) |
| **ZDI** | [ZDI-26-543](https://www.zerodayinitiative.com/advisories/ZDI-26-543/) (ZDI-CAN-30441) |
| **Vendor advisory** | [MSRC CVE-2026-54984](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54984) |
| **CWE** | [CWE-122](https://cwe.mitre.org/data/definitions/122.html) — Heap-based Buffer Overflow |
| **CVSS v3.1 base** | **7.8** HIGH — `AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` |
| **CVSS v3.1 temporal** | 6.8 — `E:U/RL:O/RC:C` |
| **Severity / Impact** | Important / Remote Code Execution |
| **Vendor** | Microsoft |
| **CNA** | Microsoft |
| **Reported to vendor** | 2026-06-02 |
| **Public disclosure** | 2026-08-11 |
| **Publicly disclosed before patch** | No |
| **Exploited in the wild** | No |
| **Exploitability assessment** | Exploitation Unlikely (Microsoft) |
| **Credit** | Kağan Çapar |
## What the advisories say
**ZDI-26-543** — *Microsoft Windows ICC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability*
ZDI attributes the flaw to insufficient validation of user-supplied data during the parsing of **ICC color profiles** in **`Mscms.dll`**, which allows a write past the end of an allocated buffer. The advisory states that user interaction is required, and that an attacker can leverage the issue to execute arbitrary code in the context of the current process.
**Microsoft** — *Windows Imaging Component Remote Code Execution Vulnerability*:
> Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.
### The two records label the component differently
Worth noting for anyone cross-referencing them: ZDI names **`Mscms.dll`** (the Windows color management library, which parses ICC profiles), while Microsoft files the CVE under the **Windows Imaging Component** tag. Both descriptions are of the same CVE.
The difference is one of vantage point rather than contradiction. Microsoft's update guide categorizes by the product surface it ships and patches; ZDI names the library its analysis covered. Windows Imaging Component is the imaging pipeline that decodes image files, and images routinely carry embedded ICC color profiles that get handed to color management — so "ICC file parsing" and "Windows Imaging Component" describe two ends of the same path.
If you are matching this CVE against an internal inventory, search on both names.
## Attack characteristics
Read from the CVSS vector `AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`:
| Metric | Value | Meaning |
|---|---|---|
| Attack Vector | Local | Not remotely reachable over the network on its own |
| Attack Complexity | Low | No special conditions |
| Privileges Required | None | No account needed on the target |
| **User Interaction** | **Required** | The target must open or process attacker-supplied content |
| Scope | Unchanged | Impact stays within the vulnerable component's authorization scope |
| Confidentiality / Integrity / Availability | High / High / High | Code execution in the context of the current process |
The `AV:L` + `UI:R` combination is the classic file-parsing shape: the file arrives by whatever means (download, share, mail attachment, embedded in a document), and the vulnerability triggers when it is processed locally. "Local" here describes where the parsing happens, not that the attacker needs prior access.
The temporal vector `E:U/RL:O/RC:C` reads: exploit code **unproven**, an **official fix** is available, and the report is **confirmed**.
## Affected products and patches
Microsoft lists 30 affected product entries; NVD's analysis (`vulnStatus: Analyzed`) resolves them to 24 CPE matches carrying the **fixed build number** for each branch. Combining both — you are affected if your build is **below** the number in the *Fixed at build* column:
| Branch | Fixed at build | Architectures | KB |
|---|---|---|---|
| Windows 11 26H1 | `10.0.28000.2704` | x64, ARM64 | [KB5121000](https://support.microsoft.com/help/5121000) |
| Windows 11 25H2 | `10.0.26200.9106` | x64, ARM64 | [KB5121003](https://support.microsoft.com/help/5121003) |
| Windows 11 24H2 | `10.0.26100.9106` | x64, ARM64 | [KB5121003](https://support.microsoft.com/help/5121003) |
| Windows 11 23H2 | `10.0.22631.7517` | x64, ARM64 | [KB5120240](https://support.microsoft.com/help/5120240) |
| Windows 10 22H2 | `10.0.19045.7663` | x86, x64, ARM64 | [KB5120249](https://support.microsoft.com/help/5120249) |
| Windows 10 21H2 | `10.0.19044.7663` | x86, x64, ARM64 | [KB5120249](https://support.microsoft.com/help/5120249) |
| Windows 10 1809 | `10.0.17763.9115` | x86, x64 | [KB5120238](https://support.microsoft.com/help/5120238) |
| Windows 10 1607 | `10.0.14393.9418` | x86, x64 | [KB5120418](https://support.microsoft.com/help/5120418) |
| Windows Server 2025 | `10.0.26100.33222` | x64 | [KB5120233](https://support.microsoft.com/help/5120233) |
| Windows Server 2022 | `10.0.20348.5440` | — | [KB5120242](https://support.microsoft.com/help/5120242) |
| Windows Server 2019 | `10.0.17763.9115` | — | [KB5120238](https://support.microsoft.com/help/5120238) |
| Windows Server 2016 | `10.0.14393.9418` | — | [KB5120418](https://support.microsoft.com/help/5120418) |
| Windows Server 2012 R2 | *(no build range published)* | — | [KB5120385](https://support.microsoft.com/help/5120385) |
| Windows Server 2012 | *(no build range published)* | — | [KB5120386](https://support.microsoft.com/help/5120386) |
Server Core installations of each Server SKU are affected and take the same KB.
### Checking your own build
```cmd
winver
```
or, for the full build with UBR:
```powershell
[System.Environment]::OSVersion.Version; (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR
```
Compare against the table. Build numbers come from NVD's CPE data; where the two disagree, the installed KB is the authoritative check — Server 2025 in particular carries an unusually high UBR in the NVD record, so verify by KB rather than by build on that SKU.
The affected range Microsoft lists for this update runs from Windows Server 2012 through Windows 11 26H1. Server 2012 and 2012 R2 are past end of extended support and receive this fix through Extended Security Updates.
**Mitigation:** install the update for your branch. The vendor advisory documents no workaround and no configuration-based mitigation.
## Timeline
| Date | Event |
|---|---|
| 2026-06-02 | Reported to Microsoft through ZDI (ZDI-CAN-30441) |
| 2026-08-11 | Microsoft publishes the fix — August 2026 update cycle |
| 2026-08-11 | ZDI-26-543 published; NVD record published |
| 2026-08-12 | NVD analysis completed (`Analyzed`), record last modified |
70 days from vendor notification to coordinated public disclosure, well inside ZDI's 120-day window. No public disclosure before the patch, and no observed exploitation.
## References
- [ZDI-26-543](https://www.zerodayinitiative.com/advisories/ZDI-26-543/)
- [MSRC — CVE-2026-54984](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54984)
- [NVD — CVE-2026-54984](https://nvd.nist.gov/vuln/detail/CVE-2026-54984)
- [CVE.org record](https://vulners.com/cve/CVE-2026-54984)
- [CWE-122: Heap-based Buffer Overflow](https://cwe.mitre.org/data/definitions/122.html)
## Credit
**Kağan Çapar** — [GitHub](https://github.com/kagancapar) · [Exploit-DB](https://www.exploit-db.com/?author=9507) · [LinkedIn](https://linkedin.com/in/kagancapar) · [X](https://x.com/kagancapar)
Credited in [ZDI-26-543](https://www.zerodayinitiative.com/advisories/ZDI-26-543/) and acknowledged by Microsoft for CVE-2026-54984.
Türkçe: [tr/CVE-2026-54984-TR.md](tr/CVE-2026-54984-TR.md)