Windows Imaging Component Remote Code Execution VulnerabilityVendor advisorypatch
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54984 CVE-2026-54984
HIGH
Windows Imaging Component Remote Code Execution Vulnerability
Record summary
CVE-2026-54984 has a selected CVSS score of 7.8 (high); EIP currently links 1 repository PoC.
Description
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.
Description source: GitHub Advisory
Exploitation context
Available material
- Repository PoCs
- 1
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 12, 2026 · Source: CVE List
Affected products and versions
Showing 12 of 19| Product | Source | Version range | Status |
|---|---|---|---|
Windows 10 Version 1607Browse Microsoft / Windows 10 Version 1607 | CVE List | 10.0.14393.0 to < 10.0.14393.9418 | affected |
Windows 10 Version 1809Browse Microsoft / Windows 10 Version 1809 | CVE List | 10.0.17763.0 to < 10.0.17763.9115 | affected |
Windows 10 Version 21H2Browse Microsoft / Windows 10 Version 21H2 | CVE List | 10.0.19044.0 to < 10.0.19044.7663 | affected |
Windows 10 Version 22H2Browse Microsoft / Windows 10 Version 22H2 | CVE List | 10.0.19045.0 to < 10.0.19045.7663 | affected |
Windows 11 Version 23H2Browse Microsoft / Windows 11 Version 23H2 | CVE List | 10.0.22631.0 to < 10.0.22631.7517 | affected |
Windows 11 Version 24H2Browse Microsoft / Windows 11 Version 24H2 | CVE List | 10.0.26100.0 to < 10.0.26100.9168 | affected |
Windows 11 Version 25H2Browse Microsoft / Windows 11 Version 25H2 | CVE List | 10.0.26200.0 to < 10.0.26200.9168 | affected |
Windows 11 version 26H1Browse Microsoft / Windows 11 version 26H1 | CVE List | 10.0.28000.0 to < 10.0.28000.2704 | affected |
Windows Server 2012Browse Microsoft / Windows Server 2012 | CVE List | 6.2.9200.0 to < 6.2.9200.26280 | affected |
Windows Server 2012 (Server Core installation)Browse Microsoft / Windows Server 2012 (Server Core installation) | CVE List | 6.2.9200.0 to < 6.2.9200.26280 | affected |
Windows Server 2012 R2Browse Microsoft / Windows Server 2012 R2 | CVE List | 6.3.9600.0 to < 6.3.9600.23338 | affected |
Windows Server 2012 R2 (Server Core installation)Browse Microsoft / Windows Server 2012 R2 (Server Core installation) | CVE List | 6.3.9600.0 to < 6.3.9600.23338 | affected |
Proofs of concept
1Repository PoCs
GitHubkagancapar/CVE-2026-54984Repository PoCby kagancaparStars: 0Writeup2 files
Analysis
Technical assessment
A public disclosure record for CVE-2026-54984, a heap-based buffer overflow in Windows ICC file parsing. The repository contains no proof-of-concept code or technical analysis, only advisory identifiers, scoring, affected builds, patch KBs, and a timeline assembled from vendor and ZDI advisories.
Backdoor review
No backdoor observed in reviewed code
The repository contains only two Markdown files (English and Turkish) that document the CVE-2026-54984 vulnerability disclosure. The README explicitly states it contains no proof of concept or technical analysis. No executable code, scripts, shellcode, or commands are present. The content is purely informational, summarizing public advisories, affected products, and a timeline.
ClassificationWriteup
Model confidence100%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The artifact is a writeup because it provides substantive technical analysis of CVE-2026-54984, including vulnerability description, attack characteristics, affected products, and a disclosure timeline, without containing any exploit or scanner code. The author explicitly states the repository contains no PoC or technical analysis, but the assembled advisory information constitutes a writeup.
README.md:8README.md:28-44README.md:46-61Requirements
- User interaction is required; the target must open or process attacker-supplied content (e.g., a malicious ICC color profile).
README.md:55
Observed behavior
- The artifact describes the vulnerability as a heap-based buffer overflow in Mscms.dll during ICC profile parsing, allowing an out-of-bounds write that can lead to arbitrary code execution in the context of the current process.
README.md:32README.md:36 - The artifact provides a table of affected Windows versions and their fixed build numbers, along with corresponding KB articles.
README.md:67-82 - The artifact explicitly states it contains no proof of concept and no technical analysis.
README.md:8
Behaviors behind the backdoor verdict
Observables
- Disclosure
- The README explicitly states: 'It contains no proof of concept and no technical analysis.'Confirms the artifact is a documentation-only repository with no executable exploit code.
README.md:8
What the analysis did not establish
- The artifact contains no executable code, no proof-of-concept, and no original technical analysis beyond what is stated in the vendor and ZDI advisories. The author notes that ZDI acquisition terms grant exclusivity over technical detail.
- Review is limited to the two text files provided; no other files exist in the repository snapshot.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
References
2nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-54984