What the advisories say

ZDI-26-543 — Microsoft Windows ICC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI attributes the flaw to insufficient validation of user-supplied data during the parsing of ICC color profiles in Mscms.dll, which allows a write past the end of an allocated buffer. The advisory states that user interaction is required, and that an attacker can leverage the issue to execute arbitrary code in the context of the current process.

Microsoft — Windows Imaging Component Remote Code Execution Vulnerability:

Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.

The two records label the component differently

Worth noting for anyone cross-referencing them: ZDI names Mscms.dll (the Windows color management library, which parses ICC profiles), while Microsoft files the CVE under the Windows Imaging Component tag. Both descriptions are of the same CVE.

The difference is one of vantage point rather than contradiction. Microsoft's update guide categorizes by the product surface it ships and patches; ZDI names the library its analysis covered. Windows Imaging Component is the imaging pipeline that decodes image files, and images routinely carry embedded ICC color profiles that get handed to color management — so "ICC file parsing" and "Windows Imaging Component" describe two ends of the same path.

If you are matching this CVE against an internal inventory, search on both names.

Attack characteristics

Read from the CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H:

The AV:L + UI:R combination is the classic file-parsing shape: the file arrives by whatever means (download, share, mail attachment, embedded in a document), and the vulnerability triggers when it is processed locally. "Local" here describes where the parsing happens, not that the attacker needs prior access.

The temporal vector E:U/RL:O/RC:C reads: exploit code unproven, an official fix is available, and the report is confirmed.

Affected products and patches

Microsoft lists 30 affected product entries; NVD's analysis (vulnStatus: Analyzed) resolves them to 24 CPE matches carrying the fixed build number for each branch. Combining both — you are affected if your build is below the number in the Fixed at build column:

Server Core installations of each Server SKU are affected and take the same KB.

Checking your own build

or, for the full build with UBR:

Compare against the table. Build numbers come from NVD's CPE data; where the two disagree, the installed KB is the authoritative check — Server 2025 in particular carries an unusually high UBR in the NVD record, so verify by KB rather than by build on that SKU.

The affected range Microsoft lists for this update runs from Windows Server 2012 through Windows 11 26H1. Server 2012 and 2012 R2 are past end of extended support and receive this fix through Extended Security Updates.

Mitigation: install the update for your branch. The vendor advisory documents no workaround and no configuration-based mitigation.

Timeline

70 days from vendor notification to coordinated public disclosure, well inside ZDI's 120-day window. No public disclosure before the patch, and no observed exploitation.

References

• ZDI-26-543
• MSRC — CVE-2026-54984
• NVD — CVE-2026-54984
• CVE.org record
• CWE-122: Heap-based Buffer Overflow

Credit

Kağan Çapar — GitHub · Exploit-DB · LinkedIn · X

Credited in ZDI-26-543 and acknowledged by Microsoft for CVE-2026-54984.

Türkçe: tr/CVE-2026-54984-TR.md