Windows Media CVE-2026-50433

Exploitation requires the attacker to already have local, authenticated access with at least low privileges (CVSS PR:L) on an affected Windows system and the ability to execute code or invoke the vulnerable Windows Media component locally; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The vector is local only (AV:L), so remote or network-based exploitation is not possible without a separate initial-access vector. Limiting factors: the attacker must obtain a foothold first, the target must be an unpatched affected edition (Windows 10 1607-22H2, Windows 11 24H2-26H1, or Windows Server 2012-2025), and successful exploitation depends on winning a use-after-free timing/heap-grooming condition, which can be affected by system state.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access with low complexity, low existing privileges required, no user interaction, and full high impact to confidentiality, integrity, and availability within an unchanged scope. This is a classic elevation-of-privilege profile: not remotely reachable, but powerful once an attacker already has a foothold (e.g., malware or a low-privileged account). No EPSS score was supplied, so statistical exploitation probability cannot be quantified; the vulnerability is not in CISA KEV and no POC is indicated, so there is no evidence of active or public exploitation at this time. Realistic priority is moderate-to-high for patch management: it is a reliable second-stage escalation primitive of the kind commonly chained after initial access, but it is not a drop-everything emergency absent exploitation signals. Note a minor data tension - the description and tags mention 'Denial Of Service' while the vector rates A:H and also C:H/I:H, consistent with full EoP rather than DoS-only; treat the primary impact as privilege elevation.

An attacker who already has a low-privileged foothold on a Windows host - for example via phishing malware or a compromised standard user account - invokes the vulnerable Windows Media code path with a crafted media object and grooms the heap to control the freed allocation. By winning the use-after-free race, they corrupt memory to execute code in a higher-privileged context, typically achieving SYSTEM. No public POC is indicated at time of analysis, and low attack complexity suggests exploitation would be reliable once developed.