Windows Media CVE-2026-50677

Exploitation requires local, authenticated access to the target: the CVSS vector AV:L/PR:L means the attacker must already be able to run code as at least a low-privileged user on the affected Windows 11 host (24H2, 25H2, or 26H1) and interact with the Windows Media component to trigger the use-after-free. No user interaction from a victim is needed (UI:N) and attack complexity is low (AC:L), but the requirement for a pre-existing local foothold and the absence of any remote/network vector is the primary limiting factor. Not exploitable remotely and not against machines where the attacker has no account or execution capability; scope is unchanged (S:U), so impact is confined to the local system.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable, low-complexity flaw requiring low privileges and no user interaction, with high impact across confidentiality, integrity, and availability but no scope change. This is a realistic post-compromise escalation primitive rather than an internet-facing crisis: an attacker must already have code execution or an authenticated foothold on the machine (AV:L, PR:L). No EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified here. It is not in CISA KEV and no public exploit was identified, so this is not confirmed active exploitation. Priority is moderate-to-high for multi-user, RDP, or shared workstation environments where limited users could escalate to SYSTEM, and lower for single-user endpoints where the attacker already controls the session.

An attacker who has gained a low-privileged foothold on a Windows 11 machine - for example a standard domain user on a shared or RDP-accessed workstation - runs a crafted program or opens specially malformed media that drives the Windows Media component through a use-after-free, corrupting a freed object to hijack execution and elevate to SYSTEM. No user interaction from another party and no special network position is required, but local access is mandatory (AV:L). No public exploit code was identified at time of analysis.