EUVD-2026-44257
GHSA-4895-4gj9-m7gc
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local delivery (AV:L) with required user interaction (UI:R) but no attacker authentication (PR:N); memory-corruption code execution yields full C/I/A impact with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Windows Terminal (shipped on Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2022/2025) arises from an integer overflow (CWE-190) that an unauthorized attacker can trigger, but only after luring a logged-on user into interacting with malicious content. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, so this is a defense-in-depth patch rather than an emergency, though the CVSS 7.8 reflects full confidentiality, integrity, and availability impact once triggered. Microsoft has released a patch via the MSRC update guide.
Technical ContextAI
Windows Terminal is Microsoft's modern, GPU-accelerated terminal emulator host for command-line shells (PowerShell, Command Prompt, WSL) and is distributed both as a Store app and increasingly as an in-box component on current Windows client and server builds. The root cause is CWE-190, an integer overflow or wraparound: an arithmetic operation (commonly a size, length, or index calculation) exceeds the maximum value of its integer type and wraps to a small or negative value, which then leads to undersized buffer allocation or out-of-bounds access - consistent with the 'Buffer Overflow' tag accompanying the integer-overflow classification. In this class of bug, attacker-influenced input feeds a length/offset computation inside the terminal's parsing or rendering path, and the wrapped value corrupts memory, enabling control-flow hijack and arbitrary code execution in the context of the interacting user. The CPE set confirms the affected surface spans Windows Terminal for Windows 10 and Windows 11 as well as the underlying OS builds listed.
RemediationAI
Apply the Microsoft-provided update: Patch available per vendor advisory - install the fix referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54124 through Windows Update and, for the Store-distributed Windows Terminal, ensure the app itself is updated to the latest version via the Microsoft Store or winget. An exact fixed version number is not included in the provided input data, so consult the MSRC update guide entry for the precise build. As a compensating control until patching, restrict use of Windows Terminal to trusted content and instruct users not to open untrusted files, profiles, or command output that could be rendered by the terminal, since exploitation requires user interaction; on servers, minimize interactive logons and remove or avoid launching Windows Terminal on Server Core and unattended hosts to reduce the interactive attack surface. These measures reduce exposure but do not fix the underlying overflow, so they are stopgaps pending the update.
More in Windows 10 Version 21H2
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today