EUVD-2026-100333
GHSA-668c-rfj7-mm3q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious WMV media file
-
DeliveryDeliver via web, email, or message
-
ExploitVictim opens file in decoder
-
ExecutionHeap overflow corrupts memory
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or render a maliciously crafted Windows Media Video file that is parsed by the Windows Media Video Decoder; this user-interaction requirement (CVSS UI:R) is the primary limiting factor, since there is no evidence of an automatic or server-side trigger. No non-default configuration is needed - the decoder is a standard Windows component - and the vulnerability is unauthenticated (PR:N), so no credentials or prior access are required beyond convincing the user to process the file. Realistic risk is therefore bounded by delivery and social-engineering success rather than by access controls. |
| Impact | This is a credible high-priority vulnerability but not a drop-everything emergency on the available signals. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, unauthenticated, low-complexity flaw yielding full confidentiality, integrity, and availability impact - i.e. remote code execution. The single limiting metric is UI:R: a user must open or render a malicious media file, which rules out fully automatic/wormable server-side exploitation and makes this a client-side, social-engineering-dependent bug typical of media-codec parsing flaws (CWE-122 heap overflow). No EPSS score, no CISA KEV listing, and no POC indicator were supplied, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC/automatable data provided. The CVSS vector and the prose description are consistent (both point to remote, unauthenticated code execution requiring the victim to process attacker-supplied content), so no signal conflict is present - but the absence of EPSS/KEV/POC data means real-world exploitation likelihood cannot be quantified and should be treated as unknown rather than low. Given the ubiquity of the Windows Media Video Decoder, patch prioritization is warranted on impact and footprint alone even without exploitation telemetry. |
| Exploit ScenarioDerived | An attacker crafts a malicious Windows Media Video file and delivers it via a web page, email attachment, or messaging link. When the victim opens or previews the file, the Windows Media Video Decoder mishandles attacker-controlled data on the heap, triggering a heap-based buffer overflow that executes arbitrary code in the context of the current user. No public exploit code is identified at time of analysis, and the attack requires the user to interact with (open/render) the malicious media. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Heap-based buffer overflow in the Windows Media Video Decoder allows remote, unauthenticated attackers to achieve code execution when a victim opens or renders a specially crafted Windows Media Video file. Exploitation is gated by the user-interaction requirement (CVSS UI:R) - the decoder is a standard, default-installed Windows component with no special configuration needed, so the realistic risk is bounded by delivery and social-engineering success rather than by access controls. No public exploit code or evidence of active exploitation has been identified at time of analysis (no CISA KEV listing), and no EPSS score was supplied; the overflow yields full confidentiality, integrity, and availability impact (CVSS 8.8) if triggered successfully.
RemediationAI
No exact fix version was included in the available input, so patch status is best described as "Patch available per vendor advisory" - consult the Microsoft MSRC Update Guide for CVE-2026-100220 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100220) to identify the specific patched Windows security update and applicable build numbers, and deploy it through your normal Windows Update/WSUS or patching pipeline; do not assume any version numbers beyond those the advisory states. Until patching is complete, the highest-value compensating control is limiting how untrusted WMV content reaches the decoder: strip or quarantine WMV/ASF media attachments at the email and web gateways and apply Mark-of-the-Web/attachment blocking for those types, accepting that this also blocks legitimate media sharing; disable media preview handlers, thumbnail generation, and Explorer's preview of untrusted media files so opening a folder does not implicitly parse a malicious file (trade-off: reduced end-user convenience and loss of OS-native previews), and avoid rendering untrusted WMV files in Windows Media Player or embedding applications. Removing or unregistering the Windows Media Video codec entirely is a more aggressive option that eliminates the attack path but can break legitimate video playback and any third-party application that depends on WMV/VC-1 decoding, so it is usually justified only on hardened or high-risk endpoints; running the rendering application with least privilege and with exploit mitigations (ASLR/DEP/CFG enabled) limits the post-exploitation impact but does not prevent the underlying heap overflow, since exploitation requires only user interaction with a crafted media file and no credentials.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is rooted in CWE-122, a heap-based buffer overflow, occurring in the parsing of Windows Media Video content by the Windows Media Video Decoder, which is a standard Microsoft Windows codec component for decoding WMV streams (typically carried in an ASF container and decoded by codecs in the Windows Media Video 9/VC-1 family). Because parsing occurs on attacker-supplied media data, insufficient bounds checking on a heap buffer allows memory corruption that can be steered toward arbitrary code execution in the context of the application rendering the file, such as Windows Media Player, Explorer preview/thumbnail handlers, or another application that invokes the decoder. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates the attack is network-deliverable, low complexity, requires no privileges or credentials (PR:N, i.e. unauthenticated), and depends on user interaction (UI:R), with high impact across confidentiality, integrity, and availability; the scope is unchanged (S:U), so the compromise is confined to the decoder process and its privileges. No CPE strings were provided, but the affected component is a default Windows installation rather than an add-on, so the exposure surface is the entire supported Windows installed base that handles WMV content.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File is delivered over the network (AV:N) and parsed without authentication (PR:N) but the victim must open the malicious media (UI:R); a heap overflow enabling code execution gives full C:H/I:H/A:H in the user's context (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity heap overflow in the default Windows Media Video Decoder affects all supported Windows workstations and servers, enabling remote code execution if a user opens a malicious video file. This puts organizational data, system integrity, and business continuity at risk, though exploitation requires user interaction. With no vendor patch and no public exploit identified at time of analysis, leadership should prioritize mitigation and monitoring to limit exposure.
Block .wmv file attachments at email and web gateways; disable the Windows Media Video Decoder via Group Policy or registry; enforce application whitelisting to prevent execution of untrusted media files; deploy EDR detection for anomalous child processes; conduct user awareness training on malicious video files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB