Windows Codecs Library CVE-2026-102199

Exploitation requires the Windows Codecs Library to process an attacker-supplied, malformed media file, and (per UI:R) requires victim interaction such as opening, previewing, or rendering that file in an application that invokes the codec. No authentication is required (PR:N) and the attack is network-deliverable (AV:N, e.g. web/email/messaging delivery), but the mandatory user-interaction step is the primary limiting factor and prevents unattended remote exploitation. Impact is limited to denial of service (A:H only); there is no confidentiality or integrity impact and no indication of code execution. Applies to default configurations of affected Windows client and server versions listed in EUVD-2026-100354 that use the vulnerable codec component.

This is a moderate, availability-only issue (CVSS 6.5, A:H with C:N/I:N) - a denial of service, not code execution, so it is a resilience/uptime concern rather than a breach vector. The CVSS vector (AV:N, AC:L, PR:N) favors the attacker in that it is network-reachable, low-complexity, and requires no authentication, but UI:R is the critical limiter: a user must interact (typically opening or previewing a malicious media file processed by the Codecs Library), which rules out fully wormable, drive-by, unauthenticated mass exploitation. No EPSS score was provided, the CVE is NOT on CISA KEV, and no public POC was indicated, so there is no public exploit identified at time of analysis - all three exploitation-likelihood signals are either absent or negative. Net assessment: this is a patch-on-normal-cycle item, not an emergency; the ubiquity of Windows raises the aggregate exposure, but the availability-only impact plus required user interaction keep real-world priority modest. No signals conflict; the main gap is the absence of EPSS and any exploit-maturity data.

An attacker crafts a malformed media file (image or video) that triggers a stack-based buffer overflow when parsed by the Windows Codecs Library, and delivers it via a web page, email attachment, or chat where the victim opens or previews it. Because UI:R applies, the victim must interact with the content; successful triggering crashes the affected application or service, causing a denial of service. No public exploit code has been identified at time of analysis.