Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of…

Description

Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of multiple Unicode combining characters, aka a "Zalgo text" attack. NOTE: third parties dispute whether the computational cost of interpreting Unicode data should be considered a vulnerability.

Scores

No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Deferred.

EPSS (exploitation in 30 days)

0.26% · top 82% of all CVEs (2 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: total

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.

Weakness

• n/a
• CWE-176 Improper Handling of Unicode Encoding (opens in a new tab)

Affected products

• n/a

  • affected n/a

References (3)

• https://talk.dynalist.io/t/dynalist-is-vulnerable-to-zalgo/1234 (opens in a new tab)x_transferred
• https://en.wikipedia.org/wiki/Zalgo_text (opens in a new tab)x_transferred
• https://aka.ms/windowsbugbar (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Record last updated 8 Aug 2024, 18:54 UTC.