Windows Media CVE-2026-58542

Exploitation requires a user on an affected system (Windows 11 Version 24H2, 25H2, 26H1, or Windows Server 2025) to open or process an attacker-supplied crafted media file handled by the Windows Media component - the CVSS UI:R metric confirms user interaction is mandatory, and AV:L confirms the vector is local (file/data delivery), not remote network exploitation. No attacker authentication or prior privileges are needed (PR:N), so any user who opens the malicious file can be compromised. The principal limiting factors are the requirement to socially engineer a user into opening the file and the restriction of the affected surface to Microsoft's newest 2024H2-and-later Windows 11 and Windows Server 2025 builds; older Windows releases are not listed as affected in the provided CPE data.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8 High) describes a locally-vectored, user-interaction-dependent flaw with no privileges required but full CIA impact, consistent with a file-open exploitation model rather than remote network reach. No EPSS score, KEV listing, or SSVC decision was supplied, so exploitation probability and automatability cannot be quantified from the input; the absence of a KEV entry and any POC reference means there is no public exploit identified at time of analysis. The practical priority is moderate-to-high: the AV:L plus UI:R combination meaningfully limits mass exploitation (an attacker must deliver a file and get a user to open it), but code execution in a Windows-native media parser is a proven phishing/drive-by vector, so patching should not be deprioritized. Note the AV:L/UI:R pairing means 'unauthorized' in the description maps to PR:N (no attacker credentials needed) - not remote/network access - verify deployment exposure accordingly.

An attacker crafts a malicious media file that triggers the heap overflow in Windows Media and delivers it via phishing email, a chat link, or a compromised website. A user on Windows 11 24H2/25H2/26H1 or Windows Server 2025 opens or previews the file, satisfying the required user interaction, and the corrupted heap yields arbitrary code execution in the user's context. No public exploit is identified at time of analysis, but the file-delivery model is well-suited to targeted social engineering.