Microsoft DirectMusic CVE-2026-69491

Exploitation requires the DirectMusic subsystem to parse attacker-controlled media data; the crafted content must reach a Windows system that invokes DirectMusic (an application or service using the DirectX audio stack). The CVSS vector claims no privileges and no user interaction (PR:N/UI:N), but as a media-parsing bug the realistic trigger is a victim opening or otherwise processing malicious media, which functions as a practical limiting factor. It affects all listed Windows client and server builds below the fixed versions, including Server Core installations; systems that never process untrusted media through DirectMusic have effectively no exposure.

The CVSS 3.1 base score of 9.8 with AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H describes worst-case unauthenticated remote code execution with no user interaction. That rating warrants scrutiny: DirectMusic is a media-parsing component and Microsoft's phrasing ('execute code over a network') most commonly maps to an attacker supplying crafted media content that the victim processes, which in practice usually implies some user interaction (opening/streaming a file) - so UI:N and AC:L may overstate real-world ease relative to a pure network-listener RCE. No EPSS score, KEV entry, or POC was provided; the flaw is reported by Microsoft's own security team (secure@microsoft.com), consistent with internal discovery/coordinated disclosure rather than observed in-the-wild abuse. Net: patch it on Patch Tuesday cadence as a critical Windows RCE, but there is no signal of active exploitation, and the practical attack likely requires delivering malicious media to a victim.

An attacker crafts a malicious DirectMusic media resource (embedded in a file, web page, or streamed content) with manipulated size fields, then lures a user or service into processing it. The DirectMusic parser under-allocates a heap buffer and overflows it, allowing the attacker to corrupt heap structures and execute code in the context of the processing application. No public POC has been identified at time of analysis.