Microsoft Windows ICC File Parsing Vulnerability Allows Remote Code Execution
A critical vulnerability in Microsoft Windows' ICC file parsing, tracked as CVE-2026-54984, allows attackers to execute arbitrary code on affected systems.
A significant remote code execution vulnerability has been identified in Microsoft Windows, stemming from flaws in how the operating system parses ICC color profiles. The vulnerability, officially designated CVE-2026-54984, resides within the Mscms.dll library, a component responsible for color management.
Attackers can exploit this flaw by crafting malicious ICC files. When these specially prepared files are processed by the vulnerable Mscms.dll library, it can lead to an out-of-bounds write. This memory corruption vulnerability allows an attacker to execute arbitrary code within the context of the currently running process on the affected Windows system.
The specific weakness lies in the inadequate validation of user-supplied data during the parsing of ICC color profiles. This lack of proper sanitization permits an attacker to write data beyond the boundaries of an allocated buffer, a common precursor to code execution exploits. The Zero Day Initiative, which disclosed the vulnerability, assigned it a CVSS score of 7.8, indicating a high severity.
Microsoft has acknowledged the vulnerability and has released security updates to address it. Users are strongly advised to apply the latest patches provided by Microsoft to mitigate the risk of exploitation. Further details on the specific update can be found on Microsoft's Security Update Guide.
The vulnerability was reported to Microsoft on June 2, 2026, and the coordinated public release of the advisory occurred on August 11, 2026. The advisory was updated on the same day, indicating ongoing information dissemination.
This vulnerability was discovered and reported by Kağan Çapar, also known as kagancapar. The disclosure highlights the persistent threat posed by vulnerabilities in core system components, particularly those related to file parsing and data handling.
While the exact attack vectors may vary depending on the specific implementation and how the Mscms.dll library is invoked, the core mechanism involves tricking a user into processing a malicious ICC file. This could occur through various means, such as email attachments, downloaded files, or even web pages that automatically process such files.
This discovery underscores the importance of timely patching and robust security practices. Organizations should ensure their systems are up-to-date with the latest security advisories and patches from Microsoft to protect against such critical vulnerabilities.