Windows Media CVE-2026-50415

The attacker must be able to reach the Windows Media component over a network and induce it to process attacker-influenced media content; the CVSS vector (AV:N/AC:L/PR:N/UI:N) advertises no authentication and no user interaction against affected Windows builds. What limits exploitation in practice: the outcome is confined to information disclosure (C:H, I:N, A:N) with only 'partial' technical impact per SSVC, it is rated non-automatable, and the target system must be running a pre-patch build of an affected edition (below the fixed versions listed by EUVD). Note the caveat that many Windows Media disclosure bugs in practice depend on the victim opening or streaming malicious media, which would contradict the UI:N/PR:N metrics - verify the precise trigger against the MSRC advisory before relying on the 'no user interaction' assumption.

The signals converge on a moderate, not urgent, priority. CVSS 3.1 rates it 7.5 High driven entirely by high confidentiality impact (C:H) with no integrity or availability effect, and an easy vector (AV:N/AC:L/PR:N/UI:N). However, CISA's SSVC framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', which tempers the raw score - this is a real but bounded information leak, not a system-takeover bug. EPSS at 0.58% (44th percentile) indicates low near-term exploitation probability, consistent with no KEV listing and no known public exploit. The one point worth verifying: CVSS advertises PR:N/UI:N (fully unauthenticated, no user interaction), yet Windows Media disclosure bugs frequently require the victim to open or stream attacker-supplied media - if that is the case here, real-world exploitation is harder than the vector suggests. Bottom line: patch on the normal Patch Tuesday cadence; it does not warrant emergency out-of-band action.

An attacker delivers a specially crafted media stream or file to a target, or exposes a malicious media service on the network; when the Windows Media component processes it, the parser returns sensitive residual memory or protected data back to the attacker over the network. Because the CVSS vector is AV:N/AC:L, the exploitation is technically low-complexity and network-reachable, though no public exploit code has been identified and SSVC rates the vulnerability as not automatable.