CVE-2026-45606

What it actually does

CVE-2026-45606 is a local out-of-bounds read vulnerability in the Microsoft UxTheme Library, uxtheme.dll. An attacker who already has authorized local access can trigger the flaw without user interaction, causing the affected Windows system or process using the library to crash or become unavailable. The reported impact is denial of service only; the CVSS vector does not indicate confidentiality loss, integrity compromise, remote exploitation, or privilege escalation.

Why it matters to the business

The main business risk is disruption of Windows workstations or servers where an authenticated local user or already-compromised account can repeatedly crash affected components or destabilize systems. This could interrupt user productivity, hosted workloads, administrative sessions, or endpoint availability. The CVSS score is moderate, EPSS is low, it is not listed in CISA KEV, and there is no reported exploit maturity, so this should be handled through normal patch management unless the affected systems are shared, high-availability, kiosk, VDI, terminal server, or multi-user Windows environments where local denial of service has greater operational impact.

How an attack unfolds

An attacker first obtains local authenticated access to an affected Windows system, such as through a standard user account, an interactive logon, or code execution gained by another method. The attacker then invokes functionality that causes uxtheme.dll to parse or process crafted theme-related data or API inputs in a way that triggers an out-of-bounds read. Because the vulnerable library reads memory outside the intended bounds, the targeted process or system component may crash, resulting in denial of service. The vulnerability is local, requires low privileges, requires no user interaction, and is not currently known to be exploited in the wild.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-45606 for all affected Windows versions, including supported Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025 releases. Because no fixed version values were provided, use the applicable Microsoft Security Update Guide entry and Windows Update, WSUS, Microsoft Configuration Manager, Intune, or equivalent patch management tooling to deploy the latest cumulative update for each supported platform. Prioritize multi-user servers, remote desktop session hosts, VDI images, kiosk systems, jump servers, and availability-sensitive endpoints. Where immediate patching is not possible, reduce local interactive access, restrict untrusted users from shared Windows systems, enforce least privilege, monitor for repeated local application crashes involving uxtheme.dll, and ensure systems can be rapidly restarted or failed over if availability is affected.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows system has installed the Microsoft cumulative update or security update that includes the fix for CVE-2026-45606. Use enterprise patch reporting, Windows Update history, WSUS or Intune compliance views, or PowerShell inventory of installed hotfixes and OS build numbers. Validate that no unsupported Windows builds remain exposed. For high-risk shared systems, perform controlled testing in a non-production environment to ensure theme/UI-related workflows no longer trigger crashes. Also review reliability and event logs after patching to confirm there are no recurring crashes in processes loading uxtheme.dll.

Typical attack path

1. Gain local authenticated access to an affected Windows workstation or server.
2. Prepare or invoke crafted theme/UI-related input that reaches Microsoft UxTheme Library processing.
3. Trigger the out-of-bounds read condition in uxtheme.dll.
4. Cause the affected process, session, or system component to crash or become unavailable.
5. Repeat the trigger as needed to sustain local denial of service.

How to detect it

To determine whether this vulnerability may have been exploited, review Windows telemetry for repeated local crashes or hangs involving uxtheme.dll, especially on unpatched systems and especially when the same user account or process repeatedly triggers failures. Useful sources include Windows Application and System Event Logs, Windows Error Reporting records, Reliability Monitor data, EDR process crash telemetry, endpoint timeline data, and helpdesk or monitoring alerts for unexpected reboots, application crashes, or session instability. Focus on Event ID 1000 application crashes where the faulting module is uxtheme.dll, Event ID 1001 Windows Error Reporting entries tied to the same crash, service termination events, and clusters of crashes shortly after local logon or execution of unusual user-controlled binaries or scripts. Because no public exploit indicators or threat actors are currently reported, detection should be behavior-based rather than signature-based, centered on anomalous crash frequency and affected-module evidence.

• Faulting module name: uxtheme.dll
• uxtheme.dll
• Event ID 1000
• Event ID 1001
• Application Error
• Windows Error Reporting
• Faulting module path: C:\Windows\System32\uxtheme.dll
• Faulting module path: C:\Windows\SysWOW64\uxtheme.dll

What your security team should do

• Inventory affected Windows client and server versions and map them to the applicable Microsoft security update or latest cumulative update.
• Prioritize patching for shared, multi-user, internet-adjacent administrative, VDI, RDS, kiosk, and business-critical Windows systems.
• Use centralized patch management to deploy and verify updates, and track exceptions for systems that cannot be immediately patched.
• Restrict local interactive logon rights and standard user access on sensitive Windows servers to reduce the opportunity for local denial-of-service abuse.
• Monitor Windows Event Logs, Windows Error Reporting, EDR telemetry, and reliability data for repeated crashes involving uxtheme.dll or theme/UI-related processes.
• Treat repeated local crashes on shared systems as potentially malicious until correlated with patch status and user activity.
• Maintain compensating controls and restart/failover procedures for systems that cannot be patched promptly.