Windows Media CVE-2026-50398

Exploitation requires an authenticated foothold (CVSS PR:L) with network reachability to the Windows Media component on an affected build (Windows 11 24H2/25H2/26H1 or Windows Server 2025). Success is gated by winning a timing-dependent race condition (reflected in AC:H) that the attacker does not fully control, so it is non-deterministic and may require many attempts; no user interaction is needed (UI:N). Limiting factors: the attacker must already have valid low-privilege credentials/access, must reach the vulnerable service across the network, and must repeatedly hit a narrow concurrency window - making reliable, automated exploitation difficult (SSVC Automatable: no).

The CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - network reachable but high attack complexity because the attacker must reliably win a timing race, and low privileges are required (authenticated). EPSS is low at 0.47% (38th percentile), and CISA SSVC scores Exploitation: none and Automatable: no, consistent with a non-trivial, non-scriptable attack; however Technical Impact is rated total, matching the C:H/I:H/A:H claim. These signals align: real but not urgent - high potential impact gated by high complexity and the need for existing authenticated access, with no evidence of active exploitation. The main uncertainty is the impact label conflict (description says privilege elevation, tags say information disclosure); the high-complexity race condition means widespread automated exploitation is unlikely, so this is a patch-in-normal-cycle priority rather than an emergency, absent KEV listing.

An attacker who already holds low-privileged authenticated access sends concurrent, precisely timed requests to the Windows Media component over the network, repeatedly attempting to win the race window in the unsynchronized shared-resource access. On a successful timing hit they corrupt privileged state to elevate their privileges, potentially gaining total control over confidentiality, integrity, and availability of the target. No public exploit identified at time of analysis, and the high attack complexity means many attempts may be needed to succeed.