Executive brief
Windows Terminal is a modern host application for command-line tools and shells like Command Prompt, PowerShell, and WSL. A security vulnerability in this tool could allow an attacker to execute malicious code on a user's computer if the user is tricked into performing a specific action, such as opening a malicious file or visiting a compromised site that interacts with the terminal. This could lead to a full system compromise, allowing the attacker to steal data or install further malware.
Technical details
This vulnerability is classified as an integer overflow or wraparound (CWE-190) that leads to a heap-based buffer overflow (CWE-122) within Windows Terminal. The flaw exists in how the application handles specific input, which can be manipulated to cause memory corruption. An attacker can exploit this by convincing a user to open a specially crafted file or interact with malicious terminal output. Successful exploitation allows for local code execution with the privileges of the logged-in user. Microsoft has released security updates to address this issue across affected versions of Windows and Windows Terminal.
Affected products
- Microsoft Windows Terminal < 1.24.11321.0
- Microsoft Windows 10 Version 21H2, 22H2
- Microsoft Windows 11 Version 24H2, 25H2, 26H1
- Microsoft Windows Server 2022 All versions
- Microsoft Windows Server 2025 All versions
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory