EUVD-2026-43872
GHSA-c535-7qm4-h8xw
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local code execution requiring an existing low-privileged foothold (AV:L, PR:L), no user interaction, with full code-execution impact on the local system (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.
AnalysisAI
Local code execution in the Windows Media component of Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 allows an authenticated local attacker to run arbitrary code by triggering a heap-based buffer overflow. Successful exploitation yields high confidentiality, integrity, and availability impact within the current security context, and Microsoft has released a patch. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Technical ContextAI
The vulnerability resides in Windows Media, the multimedia framework in modern Windows client and server editions responsible for parsing and rendering audio/video content and container/codec formats. The root cause is CWE-122 (Heap-Based Buffer Overflow): during processing of attacker-influenced media data, the component writes past the bounds of a heap-allocated buffer, corrupting adjacent heap metadata or object pointers. Per the CPE data, the affected code ships in Windows 11 version 24H2, 25H2, and 26H1, plus Windows Server 2025 including the Server Core installation, indicating a shared media-handling library across these builds. Controlled heap corruption of this kind is a classic primitive for hijacking control flow and achieving arbitrary code execution.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-50327 to all affected systems (Windows 11 24H2/25H2/26H1 and Windows Server 2025 including Server Core) via Windows Update, WSUS, or your patch-management tooling; the exact fixed build numbers and KB identifiers are listed in Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50327. Because the input does not include a single exact fix version, consult that advisory for the per-SKU patched build. As a compensating control until patching, restrict which low-privileged users can execute or open untrusted media on affected hosts and limit interactive/local logon rights on servers to reduce the pool of potential attackers (trade-off: may disrupt legitimate multi-user or media workflows); on Server Core, minimizing installed roles and interactive access further reduces exposure. These controls reduce risk but do not eliminate the underlying heap overflow, so patching remains the only definitive fix.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today