VulnerabilityPublished
ZDI-26-274: Microsoft Qlib fit Deserialization of Untrusted Data Remote Code Execution Vulnerability
Source Zero Day Initiative
0
Severity
HighRated High by Zero Day Initiative
Data as of 26 May 2026, 20:33 UTC
What to do
AI-suggested
An official fix for this vulnerability was released by Microsoft on May 31, 2025. Users and administrators should apply the available patch immediately to remediate this issue. Since the vulnerability requires user interaction, educating users to avoid opening untrusted files or visiting suspicious websites can reduce risk but does not replace patching.
Description
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
References
Community reviews
Loading reviews…