7.8
High
CVE-2026-25166 Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally
Description
Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Windows ADK for Windows 10, version 2004 | Versions not published | |
| Windows ADK for Windows 11, version 22H2 | Versions not published | |
| Windows ADK for Windows 11, version 23H2 | Versions not published | |
| Windows ADK for Windows 11, version 24H2 | Versions not published | |
| Windows ADK for Windows Server 2022 | Versions not published |
References
Timeline
- Published
- Last modified