#mmc

Analysis · May 8, 2026 · Colten Anderson

The researcher who reported two Windows bugs to Microsoft was exploiting a third

CVE-2025-26633 turns MMC's localization feature into a code execution vector. EncryptHub exploited it as a zero-day while simultaneously disclosing other vulnerabilities to Microsoft for credit.