{"id":"CVE-2026-25166","state":"PUBLISHED","title":"Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability","description":"Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally.","publishedAt":"2026-03-10T17:04:48.427Z","updatedAt":"2026-06-19T18:17:33.872Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft Windows ADK for Windows 10, version 2004","Microsoft Windows ADK for Windows 11, version 22H2","Microsoft Windows ADK for Windows 11, version 23H2","Microsoft Windows ADK for Windows 11, version 24H2","Microsoft Windows ADK for Windows Server 2022"],"affected":[{"vendor":"Microsoft","product":"Windows ADK for Windows 10, version 2004","versions":[{"version":"-","status":"affected"}]},{"vendor":"Microsoft","product":"Windows ADK for Windows 11, version 22H2","versions":[{"version":"-","status":"affected"}]},{"vendor":"Microsoft","product":"Windows ADK for Windows 11, version 23H2","versions":[{"version":"-","status":"affected"}]},{"vendor":"Microsoft","product":"Windows ADK for Windows 11, version 24H2","versions":[{"version":"-","status":"affected"}]},{"vendor":"Microsoft","product":"Windows ADK for Windows Server 2022","versions":[{"version":"-","status":"affected"}]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25166"],"weaknesses":["CWE-502"],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/25xxx/CVE-2026-25166.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-25166","state":"PUBLISHED","datePublished":"2026-03-10T17:04:48.427Z","dateUpdated":"2026-06-19T18:17:33.872Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2026-01-29T18:36:49.695Z"},"containers":{"cna":{"title":"Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability","descriptions":[{"lang":"en-US","value":"Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally."}],"affected":[{"vendor":"Microsoft","product":"Windows ADK for Windows 10, version 2004","versions":[{"version":"-","status":"affected"}]},{"vendor":"Microsoft","product":"Windows ADK for Windows 11, version 22H2","versions":[{"version":"-","status":"affected"}]},{"vendor":"Microsoft","product":"Windows ADK for Windows 11, version 23H2","versions":[{"version":"-","status":"affected"}]},{"vendor":"Microsoft","product":"Windows ADK for Windows 11, version 24H2","versions":[{"version":"-","status":"affected"}]},{"vendor":"Microsoft","product":"Windows ADK for Windows Server 2022","versions":[{"version":"-","status":"affected"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25166","name":"Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":7.8,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-502","description":"CWE-502: Deserialization of Untrusted Data","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2026-06-19T18:17:33.872Z"},"datePublic":"2026-03-10T14:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_11_adk_24H2:*:*:*:*:*:*:*:*","versionStartIncluding":"-"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_11_adk_23h2:*:*:*:*:*:*:*:*","versionStartIncluding":"-"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_11_adk_22H2:*:*:*:*:*:*:*:*","versionStartIncluding":"-"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2022_adk:*:*:*:*:*:*:*:*","versionStartIncluding":"-"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_10_adk_version_2004:*:*:*:*:*:*:*:*","versionStartIncluding":"-"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-11T14:49:27.115711Z","id":"CVE-2026-25166","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-22T18:57:32.266Z"}}]}}}