What is the CVSS score of CVE-2026-25166?

CVE-2026-25166 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Windows 11 23h2 are affected by CVE-2026-25166?

Windows System Image Manager contains a critical code execution vulnerability that could allow authorized users to compromise systems through malicious file deserialization.. A patch is available.

How to fix or mitigate CVE-2026-25166?

Within 24 hours: Identify all systems running Windows System Image Manager and document authorized users with access. Within 7 days: Implement network segmentation to restrict System Image Manager communications, disable the tool if not actively required, and enforce principle of least privilege on user accounts with access permissions. Within 30 days: Establish continuous monitoring for suspicious deserialization activities, conduct access reviews, and develop an expedited patching plan for deployment immediately when vendor patch becomes available.

Windows 11 23h2 CVE-2026-25166

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-10 secure@microsoft.com

Deserialization Microsoft Windows 11 23h2 Windows Server 2019 Windows Server 2022 23h2 Windows 11 26h1 Windows 10 1607 Windows Server 2016 Windows 11 24h2 Windows 10 1809 Windows 10 22h2 Windows 10 21h2 Windows Server 2022 Windows 11 25h2 Windows

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 7.8

DescriptionCVE.org

Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally.

AnalysisAI

Local code execution in Windows System Image Manager (Windows 11 23h2, Windows Server 2019/2022) through unsafe deserialization of untrusted data. An authenticated local attacker can exploit this vulnerability to execute arbitrary code with elevated privileges. No patch is currently available.

Technical ContextAI

Classified as CWE-502 (Deserialization of Untrusted Data). Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally.