Microsoft Color Management: critical remote code execution flaw (CVE-2026-96078)

What happened

On 10 November 2026, Microsoft published CVE-2026-96078 in its Security Update Guide. The flaw is a heap-based buffer overflow in Microsoft Color Management. According to Microsoft's description, it allows an unauthorized attacker to execute code over a network. The CVSS base score is 9.8, which is critical.

The vulnerability is not listed in CISA's catalogue of known exploited vulnerabilities, and the source data reports no active attacks. We do not have any public details about how the flaw can be exploited.

Who is affected

The data we have names Microsoft Exchange as the affected product. The description, however, refers to the Microsoft Color Management component. The affected product versions and builds are not part of the data available to us. Check the Microsoft advisory linked below to find out exactly which products, versions and security updates apply to you. If none of the products listed there run on your servers, you do not need to do anything.

What to do now

1. Open the Microsoft Security Update Guide entry for CVE-2026-96078 linked below. Note the affected products and the matching security updates (KB numbers).
2. Make a list of the servers that run an affected product, starting with Exchange servers and other systems that can be reached from the internet.
3. Back up the configuration, or take a snapshot of each server, before you install anything.
4. Install the security updates Microsoft lists for your products through Windows Update, WSUS or your patch management tool. For Exchange, use the update that matches your installed Cumulative Update.
5. Restart the server if the update requires it. Then check that the services are running again, for example the Exchange services, mail flow and Outlook on the web.
6. Until all servers are patched, keep the affected systems away from untrusted networks as far as you can.

How to check whether you are affected

• Compare the installed updates on each server (Settings > Windows Update > Update history, or Get-HotFix in PowerShell) with the KB numbers in the Microsoft advisory.
• On Exchange servers, check the installed build with Get-ExchangeServer | Format-List Name,AdminDisplayVersion in the Exchange Management Shell. Compare it with the fixed builds listed by Microsoft.
• A server is no longer vulnerable once the update listed in the advisory is installed and the server has been restarted if required.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-96078
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96078