CVE-2026-108457: Microsoft Windows PDF Remote Code Execution Vulnerability
Microsoft Windows PDF Remote Code Execution Vulnerability
Other sources
Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33650Patch KB5126646 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.7652Patch KB5126653 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.7807Patch KB5126657 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.5761Patch KB5126655
Event History
Frequently Asked Questions
Does exploitation require an authenticated account or user interaction?
No privileges or user interaction are required according to the provided vector. The attack vector is network-based, so an unauthorized attacker may be able to target affected systems remotely.
How difficult is exploitation expected to be?
The attack complexity is rated high. This indicates exploitation requires conditions beyond simply reaching the affected component, although those conditions are not specified in the provided data.
Which Windows platforms are listed as affected?
The affected software list includes Microsoft Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025, as well as a general Microsoft Windows entry. Specific affected builds, editions, and update levels are not provided.