Windows Media Foundation CVE-2026-57087

Exploitation requires that a targeted user open or preview an attacker-supplied media file processed by Windows Media Foundation (UI:R in the CVSS vector) - there is no self-propagating or fully remote unauthenticated path despite the description's 'over a network' phrasing, which conflicts with the AV:L local vector and should be verified against the Microsoft advisory. No privileges or prior authentication are needed on the target (PR:N), and code runs in the context of the process that parsed the file. Limiting factors: mandatory user interaction, dependence on delivering media the victim will actually open, and the affected system must be an unpatched supported Windows build (10.0 client 1607 through 26H1 or Server 2016 through 2025). CISA SSVC rates the vulnerability as not automatable, further constraining large-scale exploitation.

The signals are mixed and one is internally inconsistent. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a LOCAL attack vector requiring user interaction and no privileges, consistent with a victim opening a malicious media file - yet the free-text description says the attacker executes code 'over a network,' a contradiction that should be verified against the Microsoft advisory (Media Foundation RCE is typically file-based even when Microsoft labels it network-adjacent). EPSS is low at 0.83% (53rd percentile) and CISA SSVC records Exploitation: none and Automatable: no, so this is not currently an automatable or actively exploited threat, though Technical Impact is rated total. Combined with unauthenticated exploitation (PR:N) but mandatory user interaction (UI:R), realistic risk is moderate: high impact if a user is socially engineered into opening content, but no evidence of mass exploitation. Prioritize patching for broadly exposed endpoints, but this is a scheduled-patch item rather than an emergency.

An attacker crafts a malformed media file (or embeds malicious media in a document or web page) and delivers it via email, chat, or a link; when the victim opens or previews the content, Media Foundation parses the crafted stream, overflows a heap buffer, and executes attacker code in the user's context. No public proof-of-concept has been identified, and the CVSS complexity is low (AC:L) but exploitation depends on user interaction (UI:R).