Windows Media CVE-2026-34349

The attacker must hold a valid local user account on the affected system (PR:L per CVSS vector - unauthenticated remote exploitation is not possible). The Windows Media component must be present and invocable, which is the default state on all supported Windows 10 and Windows 11 client editions; on Windows Server editions, media components may require explicit installation as an optional feature, which limits exposure on hardened server builds. No special non-default configuration is documented as required beyond the standard Windows installation. Exploitation is further constrained by the non-automatable SSVC assessment, indicating manual effort or specific local interaction is necessary rather than a scriptable mass-exploitation approach. The local-only attack vector (AV:L) is the primary limiting factor: an attacker must first achieve authenticated local code execution through another means before this flaw can be leveraged.

The CVSS 3.1 base score of 5.5 (Medium) is driven by high confidentiality impact (C:H) offset by a local-only attack vector (AV:L) and low-privilege requirement (PR:L), with no integrity or availability impact. Real-world risk signals strongly corroborate this medium rating: EPSS at 0.36% places this in the 28th percentile, indicating exploitation is unlikely in the near term; SSVC confirms exploitation status as none and the attack as non-automatable with only partial technical impact. The vulnerability is not listed in CISA KEV and no public proof-of-concept has been identified. The most relevant threat model is insider risk or post-compromise scenarios - an attacker who has already obtained local access on a shared or multi-user system (RDS servers, kiosks, enterprise workstations) and uses this flaw to escalate information access. Despite high C:H in CVSS, the local-only vector means this is not directly remotely exploitable and does not present the same urgency as network-facing disclosure flaws.

An authenticated user with a standard (non-administrative) local account on an affected Windows system invokes the Windows Media component - for example through a crafted media file or direct API interaction - triggering the CWE-200 flaw to access sensitive information beyond their authorization level. This scenario is most relevant on shared infrastructure such as Remote Desktop Services servers, multi-user workstations, or kiosk environments where multiple users share a system and privilege separation is a security boundary. No public proof-of-concept exploit code has been identified at time of analysis.