Windows Media Foundation CVE-2026-57094

Exploitation requires the victim to open or play attacker-controlled media that is parsed by Windows Media Foundation (UI:R in the CVSS vector) - this is the concrete limiting factor: no exploitation occurs without that user action. No authentication or prior privileges are needed on the target (PR:N, unauthenticated), attack complexity is low (AC:L), and the affected component ships by default across supported Windows 10, Windows 11, and Windows Server builds, so no non-default configuration is required beyond the presence of Media Foundation. The realistic gating factors defenders can rely on are therefore user interaction and delivery of a malicious media file, not any special server-side feature toggle.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) describes a network-reachable, low-complexity, unauthenticated bug whose single gating factor is user interaction (UI:R) - the victim must open or play attacker-supplied media. That UI:R requirement, combined with no CISA KEV listing and no public exploit identified at time of analysis, tempers the raw score: this is not currently mass-exploited or wormable, and no automatable exploitation is evidenced. However, media-parsing RCEs are historically attractive for phishing and drive-by delivery, and the unauthenticated plus High-triad impact means a single successful lure yields full code execution. EPSS and SSVC decision data were not supplied in the input, so exploitation probability cannot be quantified here - treat the absence as a data gap, not as low risk. Net assessment: a genuine high priority for client and RDS/session-host fleets, weighted by exposure to untrusted media, rather than an inflated high-CVSS-but-low-real-risk finding.

An attacker emails or hosts a specially crafted audio/video file (or a link to one) and lures the target into opening it; when Windows Media Foundation parses the malformed stream, the heap-based buffer overflow triggers and runs the attacker's code in the user's security context, enabling malware installation or credential theft. Because privileges are those of the victim, a targeted user with local admin rights yields deeper compromise. No public exploit identified at time of analysis, so this reflects the CVSS-implied path (AV:N/AC:L/UI:R) rather than an observed sample.