EUVD-2026-73165
GHSA-rg94-r67x-6vxg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted media file via web or email
-
DeliveryVictim opens or previews file on unpatched Windows
-
ExploitWMF parser overflows stack buffer
-
ExecutionOverwrite return address with attacker payload
-
PersistExecute arbitrary code in victim user context
-
ImpactFull C/I/A compromise of user session
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | User interaction is required: the victim must open or trigger rendering of a malicious media file on an unpatched Windows system. The delivery vector is network-based (AV:N), so the file can be served via web download, email attachment, or embedded media content. No authentication or elevated privileges are required of the attacker (PR:N). Exploitation is limited by the UI:R requirement - passive, drive-by delivery without user action is not sufficient. The flaw applies to any Windows installation using the Media Foundation subsystem (which is enabled by default on all affected versions); no special non-default configuration is required. Systems where users do not open externally-sourced media files, or where Media Foundation access is restricted via application control policies, have reduced exposure. |
| Impact | The 8.8 CVSS score reflects a high-severity, network-reachable flaw with full C/I/A impact, tempered only by the UI:R requirement. The network attack vector combined with low complexity and no privilege requirement means any internet-exposed user who opens a crafted media file is potentially at risk, making broad enterprise exposure realistic - even a medium-sized IT environment handling media workflows should treat this as a near-term patching priority. No EPSS score was provided in the input data, and neither KEV listing nor public exploit code has been identified at time of analysis, which partially offsets the high base score in immediate triage decisions. The description-vs-CWE discrepancy (OOB read described, stack overflow assigned) introduces minor uncertainty about the precise exploitation primitive, but does not change the overall risk posture given the vendor-confirmed C:H/I:H/A:H impact. Automatable delivery via media files distributed over web or email makes this suitable for mass targeting once exploit code matures. |
| Exploit ScenarioDerived | An attacker hosts or emails a crafted media file (such as a malformed video or audio container) designed to trigger the stack-based buffer overflow in Windows Media Foundation's parsing routines. When a victim on an unpatched Windows system opens or previews the file - via Windows Media Player, a browser media element, or any application consuming the WMF pipeline - the overflow overwrites the stack return address, redirecting execution to attacker-controlled shellcode. No public exploit code has been identified at time of analysis, but the low-complexity, network-reachable nature of delivery makes this a viable candidate for phishing-driven campaigns once exploitation details become public. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Stack-based buffer overflow (CWE-121) in Windows Media Foundation enables remote code execution across a broad range of Microsoft Windows versions, from Windows 10/Server 2012 through Windows 11/Server 2025. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-delivered exploitation requiring user interaction, consistent with a malicious media file scenario where a victim opens or previews attacker-controlled content. Vendor patch is available; no public exploit code or CISA KEV listing identified at time of analysis.
RemediationAI
The primary fix is to apply the Microsoft security updates released for this vulnerability, available through Windows Update, WSUS, and the Microsoft Update Catalog. Administrators should patch to the fixed build for each affected Windows version as listed in the EUVD data: e.g., Windows Server 2016 to 10.0.14393.9512 or later, Windows Server 2019 to 10.0.17763.9245 or later, Windows 10 22H2 to 10.0.19045.7725 or later, and Windows Server 2025 to 10.0.26100.33438 or later. The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62706 should be consulted for the authoritative list of update packages. As a compensating control where immediate patching is not feasible, restricting users from opening untrusted media files via Group Policy (e.g., blocking execution of media content from the internet zone) and disabling Media Foundation-dependent features in high-risk environments can reduce exposure, though these controls limit legitimate media functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 19 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Windows Media Foundation (WMF) is Microsoft's core multimedia pipeline, used across Windows desktop and server editions for parsing, decoding, and rendering audio/video content. CWE-121 (Stack-based Buffer Overflow) describes a condition where a media-parsing routine writes beyond the bounds of a fixed-size stack buffer, enabling an attacker to overwrite the return address or adjacent stack data to redirect execution. The description text uses the phrase 'out-of-bounds read,' which conflicts with CWE-121 (write-class) and with the 'Buffer Overflow'/'Stack Overflow' tags - this inconsistency is noted and should be verified against the Microsoft Security Response Center advisory. Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network delivery of malicious media with no required privileges, but user must open the file (UI:R); successful exploitation yields full system compromise (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Windows Media Foundation stack-overflow vulnerability (CVE-2026-62706) enables remote code execution in Windows 10, Server 2012, and all newer versions when users open or preview attacker-controlled media files. Broad ecosystem impact across millions of Windows systems makes this a significant risk, especially for organizations where employees regularly access untrusted media. No public exploit code has been identified, and a vendor patch is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB