EUVD-2026-44262
GHSA-fqm2-mxm5-2mqm
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local vector with no privilege requirement; user must open a crafted file; impact is confidentiality-only with no integrity or availability consequence.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally.
AnalysisAI
Uninitialized memory exposure in the Microsoft Windows Codecs Library enables a local attacker to disclose sensitive process memory contents on affected Windows systems. The flaw (CWE-908) requires user interaction - specifically opening or processing a specially crafted media file - but demands no elevated privileges. No public exploit code exists and no active exploitation is confirmed; EPSS sits at 0.51% (40th percentile), consistent with SSVC's 'Exploitation: none' assessment, making this a medium-severity, low-urgency issue relative to the breadth of affected platforms.
Technical ContextAI
The Windows Codecs Library is a core OS component responsible for encoding and decoding media formats (images, audio, video) across the Windows platform. CWE-908 (Use of Uninitialized Resource) describes a class of flaw where memory is allocated but not zero-initialized before use; when the codecs library processes attacker-controlled media input, it may read and subsequently expose uninitialized heap or stack memory regions to the caller or an accessible output channel. The CVSS vector AV:L reflects that exploitation requires local system access, while UI:R indicates the victim must actively engage with a malicious file. Affected CPEs span the application-layer codecs library across Windows 10 (1607 through 22H2), Windows 11 (24H2, 25H2, 26H1), Windows Server 2012 through 2025, including Server Core variants. The root cause is not a logic flaw in access control but a memory-safety defect in the codec parsing pipeline itself.
RemediationAI
The primary remediation is to apply the vendor-released security update available through Microsoft Update and Windows Server Update Services (WSUS). Exact fixed builds per platform are documented in the EUVD and MSRC advisory: Windows 10 21H2 update to 10.0.19044.7548 or later, Windows 10 22H2 to 10.0.19045.7548 or later, Windows 11 24H2 and 25H2 to 10.0.26100.8875 or later, Windows 11 26H1 to 10.0.28000.2525 or later, Windows Server 2022 to 10.0.20348.5386 or later, Windows Server 2025 to 10.0.26100.33158 or later, Server 2019 to 10.0.17763.9020 or later, Server 2016 to 10.0.14393.9339 or later, Server 2012 R2 to 6.3.9600.23291 or later, and Server 2012 to 6.2.9200.26226 or later. Consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57083 for the complete cumulative update list. As a compensating control where immediate patching is not feasible, consider restricting access to shared folders or untrusted media repositories to reduce the likelihood of a user opening a crafted file; note this does not eliminate risk from downloaded or emailed files. Windows Server Core installations still require the same update path despite the reduced attack surface of the headless interface.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today