EUVD-2026-44267
GHSA-v4p6-prp9-3jcx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered media parsed without auth (AV:N/PR:N/AC:L) but requires the victim to open the file (UI:R); code execution in user context yields full C/I/A High with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Windows Media Foundation lets an unauthenticated attacker run arbitrary code in the victim's context by delivering a malicious media file or stream that the target opens or plays. The flaw affects the Media Foundation multimedia framework across supported Windows 10, Windows 11 (through 26H1), and Windows Server 2016-2025 builds, and carries CVSS 8.8. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS profile of confidentiality, integrity, and availability all rated High marks this as a high-priority client-side RCE.
Technical ContextAI
Microsoft Media Foundation (MF) is the COM-based multimedia platform built into Windows for audio/video capture, playback, transcoding, and streaming; it is invoked implicitly by many applications (media players, browsers, Office previewers, chat/collaboration clients) whenever they render media. The root cause is CWE-122, a heap-based buffer overflow, meaning a parsing or decoding routine writes past the bounds of a heap-allocated buffer - typically because a length or size field in the crafted media container/codec stream is trusted without adequate validation. Corrupting adjacent heap metadata or object pointers can be leveraged to hijack control flow and execute attacker-supplied code. The affected CPE set spans Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2016/2019/2022/2025 including Server Core installations, confirming the vulnerable component ships in the base OS rather than an optional add-on.
RemediationAI
Apply the Microsoft security update for CVE-2026-57094 for each affected SKU - patch available per vendor advisory (reported by Microsoft) - via Windows Update or WSUS/MECM; the authoritative per-build fixed versions are listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57094. Prioritize systems that process untrusted media (user endpoints, RDS/session hosts, and any server that previews or transcodes uploaded files). Until patching completes, reduce exposure by blocking or quarantining risky media attachments and downloads at the email/web gateway, discouraging users from opening media from untrusted sources, and where feasible restricting or disabling automatic media preview/thumbnail generation in mail and file clients - note this degrades user experience and preview convenience but closes the primary UI:R delivery path. No workaround fully substitutes for the update, so treat mitigations as interim only.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today