Windows Media Foundation CVE-2026-56189

Exploitation requires local access to an affected Windows build (Windows 10 1607 through Windows 11 26H1, or Windows Server 2012 through 2025) and the ability to get Windows Media Foundation to process attacker-controlled media data that triggers the heap overflow. Microsoft's vector states PR:N and UI:N, meaning no prior privileges or explicit user interaction are asserted, but the local attack vector (AV:L) inherently limits exploitation to an attacker who already has code or data-delivery access on the machine - this is not remotely reachable over the network. The practical limiter is that the attacker must already be local; the realistic trigger (feeding crafted media to the component) should be confirmed against the vendor advisory, as media-parsing bugs typically involve opening or previewing a file.

Signals converge on a serious-but-not-emergency priority. The CVSS vector is local (AV:L/AC:L/PR:N/UI:N) with total technical impact (C:H/I:H/A:H), and SSVC agrees the technical impact is total but rates exploitation 'none' and automatable 'no'; EPSS is low (0.48%, 38th percentile) and no KEV listing or POC is present, indicating no evidence of exploitation. A notable tension exists in the vector: media-parsing heap overflows almost always require a victim to open or process a crafted file, yet Microsoft's vector reports UI:N and PR:N - the AV:L/UI:N combination implies the attacker already has a local foothold and can feed data to the component without further interaction, so verify the exact trigger with the vendor advisory before assuming zero-interaction exploitation. Net: patch on the normal cycle given total impact and huge install base, but this is not a drop-everything network worm.

An attacker with a local foothold on an affected Windows host delivers or stages crafted media that Windows Media Foundation processes, triggering the heap overflow and executing code in the context of the processing component. Given AV:L and total impact, this is most useful as a local privilege-escalation or sandbox-escape primitive following initial access; no public exploit is currently known.