Windows Media Foundation CVE-2026-58610

Exploitation requires the victim to open or preview an attacker-supplied, maliciously crafted media file that is processed by the Windows Media Foundation parsing pipeline (UI:R in the CVSS vector) - there is no remote, no-click path. No prior authentication or elevated privileges on the target are needed (PR:N), and complexity is low (AC:L), so once a user is induced to open the file the bug triggers reliably; code runs at the privilege level of the opening user, not automatically SYSTEM. The principal limiting factor is the required user interaction and the need to deliver the file to and have it opened by a target running an affected Windows/Windows Server version; there is no non-default configuration prerequisite because Media Foundation is a standard OS component.

The CVSS vector describes a local, low-complexity attack requiring no privileges but user interaction (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), which is the standard profile for a file-open/media-parsing bug - the 'local' vector reflects that the attacker delivers a file the victim must open, not that they need prior host access. Impact is high across C/I/A because successful exploitation yields code execution in the victim's context. Real-world priority is tempered by the UI:R requirement: exploitation depends on convincing a user to open crafted media, so it is not automatically wormable. No EPSS score was provided, there is no KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or widespread exploitation today. Given the ubiquity of the affected platform and Media Foundation's reachability via browsers, email, and file shares, this remains a meaningful patch-soon item rather than an emergency, absent exploitation signals.

An attacker crafts a malicious media file that triggers the heap overflow when parsed by Media Foundation and delivers it via email, a web download, or a file share. When the victim opens or previews the file in an application that uses the Media Foundation pipeline, the overflow corrupts the heap and executes attacker-controlled code in the user's security context. No public exploit is identified at time of analysis, and the attack depends on the low-complexity but required user interaction.