Windows Media CVE-2026-50358

Exploitation requires the attacker to already possess authenticated, low-privileged local access to the target (CVSS PR:L, AV:L) and the ability to execute code that interacts with the Windows Media component - this is a local escalation, not a remote entry point. No user interaction is needed (UI:N) and the Windows Media component is present by default across all listed Windows 10/11 and Server 2016-2025 editions, so no non-default configuration is required to reach the vulnerable code. The primary limiting factors are the need for prior local access and a valid (even unprivileged) account; it cannot be triggered remotely or by an unauthenticated actor, which constrains it to post-compromise or malicious-insider use rather than internet-facing mass exploitation.

The signals are internally consistent and point to a real-but-not-emergency local escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) shows local attack vector, low complexity, low privileges required, and no user interaction, with total confidentiality/integrity/availability impact on the unchanged scope - classic local EoP to SYSTEM. Corroborating this, CISA SSVC rates Technical Impact as 'total' but Automatable as 'no' and Exploitation as 'none', and EPSS is low at 0.25% (16th percentile), so there is no evidence of active exploitation or mass automation. There is no KEV listing and no POC identified. The practical priority is driven by prevalence and the fact that local EoPs are frequently chained after initial access, not by imminent mass exploitation. No key signals conflict - the vector's local scope aligns with the description's 'elevate privileges locally' and the 'authorized attacker' language aligns with PR:L.

An attacker who has already obtained a standard, low-privileged account on a Windows host - for example via phishing, a stolen credential, or a compromised service - runs a crafted program that manipulates the Windows Media component's heap to trigger the use-after-free, reclaiming the freed object with controlled data. By steering the dangling-pointer dereference into code execution, the attacker elevates from their limited context to SYSTEM, gaining full control of the machine. No public exploit code has been identified at time of analysis, and the low complexity (AC:L) means a working exploit, once developed, would be reliable.