{"id":"EM-20261112-PBCI","url":"https://cyber.eventmonitor.net/incident/EM-20261112-PBCI/microsoft-color-management-vulnerability-cve-2026-96054/","type":"cve","title":"Microsoft Color Management Vulnerability (CVE-2026-96054)","subtitle":"CVE-2026-96054","subject":"CVE-2026-96054","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-12T13:16:53.000Z","firstSignal":"2026-11-10T19:22:02.743Z","lastSignal":"2026-11-12T13:16:53.000Z","updated":"2026-11-12T15:50:47.989Z","revision":1,"life":[{"status":"Born","at":"2026-11-12T13:16:53.000Z","why":"second independent source: C31 Vulners (new public exploits)"},{"status":"Developing","at":"2026-11-12T13:16:53.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-10T19:22:02.743Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-12T13:16:53.000Z","what":"Born: second source, C31 Vulners (new public exploits). Page EM-20261112-PBCI created."}],"stages":[{"name":"Disclosed","at":"2026-11-10T19:22:02.743Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-10T19:22:02.743Z","detail":"CVSS 7 · EPSS 0.3%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-10T19:22:02.743Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-96054 (CVSS 7)","text":"Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code locally.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96054"},{"at":"2026-11-12T13:16:53.000Z","source":"C31","sourceName":"Vulners (new public exploits)","role":"Research & News","severity":3,"title":"Public exploit: Exploit for CVE-2026-96054","text":"# CVE-2026-96054\n\n**Microsoft Color Management heap-based buffer overflow — remote code execution**\nReported to Microsoft, fixed in the November 2026 update cycle, published on 10 November 2026.\n\nHi, I'm [Kağan Çapar](https://github.com/kagancapar). I reported this vulnerability to Microsoft. It…","url":"https://github.com/kagancapar/CVE-2026-96054"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-10T19:22:02.743","score":7,"severity":"HIGH","desc":"Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code locally.","product":"","seen":1794357664905},"kev":null,"epss":{"epss":0.00325,"pct":0.25912,"at":1794498647989},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}