Product:
Windows System Image Manager
Summary
Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally. This vulnerability can lead to significant impacts on confidentiality, integrity, and availability. Attackers with low privileges can exploit this issue without user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2026-25166 |
Exploitation
To exploit this vulnerability, an attacker must have authorized access to the system. They can then manipulate the deserialization process to execute arbitrary code locally. Given the low attack complexity and the requirement for local access, this vulnerability poses a serious risk to affected systems.
Affected Products
- Windows System Image Manager: A tool used for creating and managing Windows images, vulnerable to code execution due to deserialization issues.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Microsoft. Users should also ensure that their systems are configured to limit unauthorized access and monitor for any suspicious activities.