What is the CVSS score of CVE-2026-54993?

CVE-2026-54993 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Windows Media Foundation are affected by CVE-2026-54993?

Microsoft Windows Media Foundation contains a local code execution vulnerability (CVE-2026-54993) affecting Windows 10, Windows 11, and Windows Server 2025 across builds 1809 through 26H1, with no…. A patch is available.

How to fix or mitigate CVE-2026-54993?

Within 24 hours, inventory all Windows systems running builds 1809 through 26H1 of Windows 10, 11, or Server 2025 to establish organizational scope; simultaneously issue a security alert instructing users to avoid opening media files from untrusted sources. Within 7 days, initiate deployment of Microsoft's released patch starting with high-risk systems (servers, administrative workstations, and public-facing systems). By day 30, complete patching across 100% of affected Windows systems; conduct post-patching verification and close the remediation ticket.

Windows Media Foundation CVE-2026-54993

EUVD-2026-44009 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-14 microsoft

GHSA-cm62-wjrc-9gqm

Buffer Overflow Heap Overflow Microsoft Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today AI

7.8 HIGH

Victim must open a crafted file, so AV:L and UI:R; no privileges needed (PR:N) and memory-corruption RCE yields full C/I/A.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:03 vuln.today

CVE Published

Jul 14, 2026 - 17:04 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Windows Media Foundation lets an unauthorized attacker run arbitrary code by luring a user into opening a specially crafted media file. The flaw affects a broad range of Windows 10, Windows 11, and Windows Server builds (from 1809 through Windows 11 26H1 and Server 2025), and Microsoft has released patches. No public exploit identified at time of analysis, but the low attack complexity and full C/I/A impact make it a standard Patch-Tuesday priority.

Technical ContextAI

Windows Media Foundation is the core multimedia platform in Windows responsible for audio/video capture, playback, and transcoding, parsing many container and codec formats through in-process COM components and codec DLLs. The vulnerability is a CWE-122 heap-based buffer overflow, meaning attacker-controlled data from crafted media content is written past the bounds of a heap-allocated buffer during parsing, corrupting adjacent heap metadata or object pointers and enabling control-flow hijack. Per the CPE data the defect spans the Media Foundation code shared across Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2019/2022/2025, indicating a common code path rather than a version-specific regression.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security update for your specific Windows or Windows Server build as listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54993 (the input does not provide a single fix version because patched builds differ per SKU - pull the exact KB/build from the MSRC page). Because exploitation requires a user to open a crafted media file, effective interim controls until patching include blocking or quarantining inbound media attachments and untrusted media downloads at the mail/web gateway, restricting or re-associating risky media file types away from Media Foundation-backed players, and enforcing Mark-of-the-Web and attack-surface-reduction rules so internet-sourced files are treated with reduced trust; the trade-off is disruption to legitimate media workflows. On servers, avoid using them to interactively open media, which naturally limits the UI:R delivery path.