Windows Media Foundation CVE-2026-69386

Exploitation requires that the target user open, preview, or otherwise trigger processing of a specially crafted media file - this is the sole prerequisite encoded in the CVSS UI:R metric. No authentication or elevated privileges are required on the attacker's side (PR:N). The attack is network-deliverable (AV:N), meaning the file can be distributed via email attachment, web page embedding, or any other channel that causes Windows Media Foundation to parse attacker-controlled content. Exploitation is limited to platforms where Windows Media Foundation is active, which includes all listed Windows 10, Windows 11, and Windows Server versions by default. Servers configured with the 'Server Core' installation option and no media-serving workload may have reduced exposure if Media Foundation is not invoked, but the component is still present and patchable. The only hard prerequisite is user interaction - a victim must be induced to process the malicious file.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H scores 8.8, reflecting a high-confidence RCE path that requires only a single user interaction - opening a maliciously crafted media file. Attack complexity is low, meaning no race conditions or special system states are required beyond delivering the file to the victim. EPSS data was not supplied, and the CVE is not listed in CISA KEV, so exploitation probability and active exploitation status are unconfirmed. No public PoC has been identified at time of analysis. Despite the absence of confirmed exploitation, the combination of AV:N, PR:N, AC:L, and full C/H/I/A impact means that even a mid-sized municipal IT team in gdynia should treat this as urgent patching work - the barrier to exploitation is primarily the social-engineering step of luring a user to open a file, which is trivially achieved via phishing or malicious web content embedding media. The scope is not changed (S:U), limiting blast radius to the victim process, but Media Foundation runs in the context of the logged-in user and is invoked by browsers, media players, and Office applications, making process-level compromise highly impactful. The absence of KEV listing reduces urgency compared to confirmed-exploited CVEs, but the breadth of affected OS versions amplifies organizational exposure.

An attacker crafts a malformed media file (e.g., a specially constructed MP4 or WMV) that triggers a heap-based buffer overflow in the Windows Media Foundation parser when processed. The attacker delivers this file to the target via a phishing email with an attachment, a malicious web page embedding the media, or a shared network resource, relying on the victim to open or preview it. Upon parsing, the overflow corrupts heap metadata or adjacent allocations, enabling the attacker to redirect execution and run arbitrary code in the context of the victim's user session. No public PoC has been identified at time of analysis.