Executive brief
A security vulnerability exists in the Microsoft Input Method Editor (IME), a component used to enter text in languages like Chinese, Japanese, and Korean. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to install programs, view or delete sensitive data, or create new accounts with full user rights.
Technical details
A heap-based buffer overflow (CWE-122) exists in the Microsoft Input Method Editor (IME). The vulnerability is triggered locally by an authorized user with low privileges. By exploiting this memory corruption issue, an attacker can achieve local privilege escalation (LPE), potentially gaining SYSTEM-level access. The vulnerability has a CVSS score of 8.8, reflecting its high impact on confidentiality, integrity, and availability, as well as its ability to cross security scopes. Microsoft has released security updates to address this issue across affected versions of Windows 10, Windows 11, and Windows Server.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 24H2, 25H2, 26H1
- Microsoft Windows Server 2016 All versions
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory