OnlyPatch
Microsoft Input Method Editor (IME)

CVE-2026-58534 — Windows Input Method Editor (IME) Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.00317 🔬 Patch diffed 2026-07 archive

Executive Summary

Heap-based buffer overflow in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.

Overview

7.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-122: Heap-based Buffer Overflow
Released Jul 14 2026
Last Updated Jul 14 2026
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00317 — 0.24348 percentile
NVD CVSS 7.8 HIGH — differs from MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 7.7

EPSS Score

0.00317
probability of exploitation in the next 30 days
0.24348 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

23 affected products
Product KB Article Severity Impact Restart Required
Windows 10 Version 1607 for 32-bit Systems 5099535 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5099535 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5099538 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5099538 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5099539 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5099539 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5099539 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5099539 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5099539 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5099539 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for ARM64-based Systems 5101650 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for x64-based Systems 5101650 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 25H2 for ARM64-based Systems 5101650 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 25H2 for x64-based Systems 5101650 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 26H1 for ARM64-based Systems 5101649 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 26H1 for x64-based Systems 5101649 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 5099535 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5099535 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5099538 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5099538 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5099540 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 5099536 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 (Server Core installation) 5099536 (Security Update) Important Elevation of Privilege Yes

Patches

7 patches
Article Type Restart
5099535 Security Update Yes
5099538 Security Update Yes
5099539 Security Update Yes
5101650 Security Update Yes
5101649 Security Update Yes
5099540 Security Update Yes
5099536 Security Update Yes

Patch Diff

ghidriff · imjpapi.dll (KB5101650)

Heap-based buffer overflow (CWE-122) in the Microsoft Japanese IME API imjpapi.dll (CLMParamSerializer, sflmelm MTF container converter), local EoP. CLMParamSerializer::Deserialize fetches a blob size from an IME property bag, allocates exactly that many bytes with operator new[], and parses the blob into a fixed 0x908-byte object. A DWORD entry count read from blob+0x128 is stored at dst+0x518 and used as the iteration count for a loop that writes 8-byte pointers beginning at dst+0x520; the next object field is at dst+0x848, giving capacity for exactly 101 (0x65) entries. PRE validates neither the blob size nor the count, so a count > 0x65 overruns the fixed object (index 124 reaches dst+0x900, past the 0x908-byte allocation) -> attacker-controlled pointer-array heap overflow. IN-HOUSE ghidriff of imjpapi.dll 10.0.26100.8521 -> .8875 (Jul 14 2026, KB5101650) confirms the fix: Deserialize is the only code-changed function and adds two independent bounds checks gated behind CFR flag Feature_801091896 - guard 1 rejects blob size < 0x178 (fully covers the fixed read at +0x174), guard 2 rejects entry count > 0x65 (the object capacity). Note: our x64 24H2 diff shows flag Feature_801091896 and guard1 < 0x178, differing from the circulated note's Feature_1069527352 / < 0x174 (build/arch difference); we ship what our diff shows.

Pre-patch version 10.0.26100.8521 Download
Post-patch version 10.0.26100.8875 Download
Function Address Change Note
CLMParamSerializer::Deserialize code change code (two blob bounds checks added, CFR-gated) Pre: `operator new[](blob_size)` unvalidated; entry count = blob+0x128 stored at dst+0x518 drives an 8-byte-pointer write loop at dst+0x520 into a fixed 0x908-byte object, no upper bound -> heap overflow past dst+0x848 (capacity 101). Post (Feature_801091896 enabled): guard1 `local_res10[0] < 0x178` throw (min blob size, covers fixed read at +0x174); guard2 `0x65 < puVar10[0x146]` throw (entry count <= 101). Both throw from mtfcontainerconverter.cpp (0x573 / 0x59d).
Feature_801091896 gate added (CFR gate) New Controlled Feature Rollout flag gating both bounds checks; the original unchecked parse still ships in .8875.
View full diff report View RCA report

Attack Path

An unbounded blob entry-count drives Deserialize's pointer loop past the fixed 0x908-byte object for a heap overflow

Attack path for CVE-2026-58534 An unbounded blob entry-count drives Deserialize's pointer loop past the fixed 0x908-byte object for a heap overflow 01 — ENTRY Low-privileged process supplies a crafted serialized LM-param blob via the IME property bag imjpapi!CLMParamSerializer::Deserialize reads the blob size and contents from an IMtfPropertyBag; the contents cross the user/IME trust boundary (CVSS S:C). 02 — CONTROLLED INPUT Blob carries an oversized entry count at blob+0x128 Deserialize allocates operator new[](blob_size), then copies blob+0x128 into the fixed object at dst+0x518 as the entry count. Pre-patch neither the blob size nor this count is validated. 03 — PATH A loop writes 8-byte pointers into the fixed 0x908-byte object, count = dst+0x518 The loop writes entries beginning at dst+0x520, 8 bytes each; the next object field begins at dst+0x848, so capacity is exactly 101 (0x65) entries. 04 — MISSING CHECK The entry count has no upper bound (CWE-122) With count > 0x65, the loop keeps writing 8-byte pointers past dst+0x848; index 124 reaches dst+0x900, outside the 0x908-byte allocation. 05 — PRIMITIVE Out-of-bounds pointer writes past the object -> heap overflow -> EoP Attacker-placed pointer values overrun the fixed heap object, corrupting adjacent heap state for elevation. The Jul 2026 fix adds two Feature_801091896-gated checks: blob size >= 0x178 and entry count <= 0x65.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

Pwnforr777

On This Page