EUVD-2026-45059
GHSA-g52r-hw2c-c98r
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered content with required victim interaction (UI:R) and non-deterministic memory-corruption conditions (AC:H), no auth needed (PR:N), yielding full code-execution impact (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Windows Terminal allows an unauthenticated attacker to run arbitrary code by tricking a user into interacting with malicious content that triggers an integer overflow (CWE-190). The flaw carries a CVSS 7.5 rating driven by high complexity and required user interaction; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Microsoft has released a patch through the MSRC update guide.
Technical ContextAI
Windows Terminal is Microsoft's modern, open-source terminal emulator application for command-line tools and shells (PowerShell, cmd, WSL), distributed via the Microsoft Store and GitHub and shipped by default on recent Windows 11 builds. The affected component is the microsoft:windows_terminal_app package. The root cause is an integer overflow or wraparound (CWE-190), where arithmetic on attacker-influenced values exceeds the storage type's range and wraps to an unexpected value, typically producing an undersized buffer allocation or incorrect bounds check that leads to a subsequent memory-corruption condition - consistent with the 'Buffer Overflow' tag applied to this issue. When triggered over a network delivery path with user interaction, the corrupted memory state is leveraged to achieve arbitrary code execution in the context of the Terminal process.
RemediationAI
Patch available per vendor advisory: update Windows Terminal to the fixed version listed in Microsoft's Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59117 - the exact fixed build is not included in the provided input and should be taken from that advisory. Because Windows Terminal is distributed through the Microsoft Store, ensure automatic Store app updates are enabled so the patched build is delivered, or manually trigger 'Get updates' in the Microsoft Store; managed environments should push the updated package via their app deployment tooling (Intune/WSUS-equivalent for Store apps). Until patched, reduce exposure by avoiding opening untrusted files, links, or remote content in Windows Terminal and by not launching the terminal to render attacker-supplied data; the trade-off is minimal operational impact since these are prudent handling practices rather than a functional feature disablement.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today