Windows Media Foundation CVE-2026-70131

Exploitation requires the attacker to get a crafted media file parsed by Windows Media Foundation on the target host, and requires local user interaction (UI:R) - a logged-in user must open, preview, or otherwise process the malicious file; it is not remotely triggerable without that interaction. The attack executes against the local component (AV:L) at low complexity (AC:L) and, per the vendor, needs no pre-existing privileges (PR:N). Limiting factors for defenders: the dependency on user interaction, the local attack vector (no network-facing exposure), and the fact that affected builds are below the specific patched versions enumerated in the EUVD data - fully updated systems are not affected.

This is a genuine prioritization candidate despite being a local privilege-escalation issue rather than a remote-code-execution flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes an attack executed locally with low complexity and no prior privileges, but requiring user interaction - consistent with a victim opening or processing a crafted media file handled by Windows Media Foundation, after which the attacker gains elevated privileges with full confidentiality, integrity, and availability impact. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no quantitative exploitation-probability signal and no evidence of active exploitation - exploitation status is therefore 'no public exploit identified at time of analysis.' One point to verify: the CVSS carries PR:N (unauthenticated) yet the class is 'elevate privileges locally,' which is typical for Media Foundation parsing bugs (an unauthorized/low-context attacker delivers a malicious file to a logged-in user), but the combination of PR:N with an EoP outcome plus UI:R means real-world exploitation hinges on social engineering or chaining with another access vector rather than standalone remote compromise. Given the ubiquity of Windows and the availability of a vendor patch, treat this as a patch-soon item, especially where media file handling is common, while recognizing the low real-world footprint for mass/automated exploitation absent a weaponized chain.

An attacker crafts a malicious media file and delivers it to a target (via email, download, or a shared location) on a patched-but-not-yet-updated Windows host. When the user opens or previews the file, Media Foundation triggers a heap-based buffer overflow (CWE-122), letting the attacker execute code at elevated privileges. No public exploit code was identified in the provided data, and the CVSS AV:L/AC:L/UI:R profile means exploitation is low-complexity but depends on local victim interaction.