EUVD-2026-43968
GHSA-pg56-99cj-qg9r
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local vector and low privilege confirmed by description and CVSS input; high confidentiality impact reflects CWE-200 sensitive data exposure; no integrity or availability impact documented.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally.
AnalysisAI
Windows Media on multiple Windows client and server editions exposes sensitive information to authenticated local users, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Affected builds span Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025, representing a broad footprint of Microsoft's supported OS ecosystem. No active exploitation has been identified at time of analysis - the vulnerability is absent from CISA KEV, EPSS sits at 0.36% (28th percentile), and SSVC assesses exploitation status as none - making this a patch-and-monitor priority rather than an emergency response.
Technical ContextAI
Windows Media is a deeply integrated media processing and playback subsystem present by default in Windows client editions and optionally on server editions. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause class as improper control over what information is accessible to a given actor - in practice this typically manifests as insufficient access checks on media metadata, in-memory data exposed via media APIs, or file-path or session data leaking through the media pipeline. The CVSS vector (AV:L/AC:L/PR:L) confirms the vulnerability is exercised locally by a standard user account with no elevated privileges. CPE data identifies all affected products as Microsoft Windows releases: client editions including Windows 10 Version 1809, 21H2, 22H2, Windows 11 Version 24H2, 25H2, 26H1, and server editions including Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core).
RemediationAI
Apply the Microsoft security update for the relevant Windows version, targeting the following minimum confirmed fix builds per EUVD data: Windows 10 1809 and Windows Server 2019 (including Server Core) to 10.0.17763.9020 or later; Windows 10 21H2 to 10.0.19044.7548 or later; Windows 10 22H2 to 10.0.19045.7548 or later; Windows 11 24H2 to 10.0.26100.8875 or later; Windows 11 25H2 to 10.0.26200.8875 or later; Windows 11 26H1 to 10.0.28000.2269 or later; Windows Server 2022 to 10.0.20348.5386 or later; and Windows Server 2025 (including Server Core) to 10.0.26100.33158 or later. Full patch guidance is published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34349. Where patching cannot be applied immediately, restrict access to Windows Media features via AppLocker or Group Policy Software Restriction Policies to limit which user accounts can invoke media components - note this will impact media playback for restricted users. On Windows Server editions where Windows Media is not an operational requirement, remove the optional media feature role to eliminate the attack surface entirely.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today