CVE-2026-25166
Published: 10 March 2026
Summary
CVE-2026-25166 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 34.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation through applying Microsoft patches directly eliminates the deserialization vulnerability in Windows System Image Manager.
Information input validation ensures untrusted data deserialized by Windows System Image Manager is checked for validity, preventing exploitation leading to code execution.
Memory protection safeguards mitigate arbitrary code execution resulting from successful deserialization attacks in Windows System Image Manager.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local deserialization vulnerability (CWE-502) in a Windows utility directly enables arbitrary code execution by a low-privileged local attacker (AV:L/PR:L/UI:N), mapping to exploitation for privilege escalation or code execution within the local context.
NVD Description
Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally.
Deeper analysisAI
CVE-2026-25166 is a deserialization of untrusted data vulnerability (CWE-502) in Windows System Image Manager. Published on 2026-03-10, it carries a CVSS v3.1 base score of 7.8 (High), with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high impacts on confidentiality, integrity, and availability.
An authorized local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows arbitrary code execution on the affected system.
The Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25166 details available patches and mitigation recommendations.
Details
- CWE(s)