Windows DirectShow CVE-2026-69715

Exploitation requires the target system to process attacker-supplied media through the Windows DirectShow framework - i.e., a crafted media file or stream must be opened or ingested by a DirectShow-backed application or service. Microsoft's vector marks UI:N and PR:N (unauthenticated), but as a media-parsing flaw it realistically depends on a user or automated pipeline actually processing the malicious media, which is the primary limiting factor. Limited to Windows builds below the fixed versions listed in EUVD-2026-73570; systems that never handle untrusted media via DirectShow are not practically exposed.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) rates this as critical unauthenticated network RCE with no user interaction. That rating is questionable for a media-parsing bug: DirectShow code execution almost always requires a victim to open or process an attacker-supplied media file or stream, which realistically implies user interaction (UI:R) rather than UI:N - a common pattern in Microsoft's media-parsing advisories. There is no EPSS score, no KEV listing, and no POC signal in the provided data, so no evidence of active or imminent exploitation; the practical risk is 'patch promptly during the normal cycle' rather than 'emergency zero-day.' Note also the internal inconsistency between the 'out-of-bounds read' description and the CWE-122 heap-overflow classification - verify the exact memory-safety primitive with Microsoft before drawing exploitability conclusions.

An attacker crafts a malicious media file or stream and delivers it to a victim (via email attachment, web page, or a network service that ingests media). When Windows DirectShow parses the crafted content, the out-of-bounds/heap condition is triggered and attacker-controlled code executes in the context of the processing application. No public exploit is identified at time of analysis.