Windows Terminal CVE-2026-54124

Exploitation requires a logged-on local user to interact with attacker-supplied content that Windows Terminal processes (CVSS UI:R and AV:L) - for example opening a malicious file/profile or rendering crafted terminal output - on a system where Windows Terminal is installed (Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, or Windows Server 2022/2025). No prior authentication or elevated privileges are needed by the attacker (PR:N), but the mandatory user interaction and local delivery are the limiting factors: there is no remote, interaction-free path, so the attack cannot be automated at scale and depends on successful social engineering of a user who has Windows Terminal available.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity flaw that requires no privileges (PR:N) but does require user interaction (UI:R), yielding high impact across all three security properties without a scope change. The unusual PR:N combined with AV:L and UI:R indicates the 'attacker' need not be authenticated to the system but must get a local user to open or process crafted content in Windows Terminal - the user interaction, not authentication, is the gating factor. No EPSS score, SSVC decision, KEV listing, or POC was provided; there is no public exploit identified at time of analysis and no evidence of active exploitation, so despite the high base score this is a moderate real-world priority rather than an urgent internet-facing threat. The main caveats: the vector is local (AV:L), meaning remote mass-exploitation is not the model, and exploitation hinges on user interaction, which limits automation and scale.

An attacker crafts malicious content - such as a terminal profile, escape-sequence-laden output, or a file designed to be rendered - and social-engineers a logged-on user into opening or displaying it in Windows Terminal. Processing the content triggers the integer overflow, corrupting memory and executing attacker-controlled code in the victim user's context. No public proof-of-concept was provided, and the local vector plus required user interaction mean the attack is targeted rather than wormable.