Windows Media CVE-2026-96071

Exploitation requires the victim to open or process a maliciously crafted media file in the Windows Media component (UI:R), so it is not a zero-click remote flaw. No authentication is required of the attacker (PR:N), but delivery depends on social engineering or an automatic media-preview/parsing path. The high attack complexity (AC:H) indicates success depends on specific heap state or a race condition, reducing reliability. Affected builds span Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012 through 2025; systems patched to the fixed builds listed by Microsoft (e.g., 10.0.19044.7807, 10.0.26100.9711) are not vulnerable.

This is a serious but not maximally urgent vulnerability. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5 HIGH) shows a remotely reachable, unauthenticated code-execution flaw with full confidentiality/integrity/availability impact, but two metrics temper real-world risk: AC:H (high attack complexity - the attacker must win a race or satisfy specific heap-grooming conditions) and UI:R (the victim must open or process a malicious media file). It is not listed in CISA KEV and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The absence of KEV/POC signals combined with AC:H suggests this is not currently a drive-by mass-exploitation threat, but because the affected component (Windows Media) ships in every supported Windows client and server SKU, the aggregate exposure is enormous and a reliable exploit would be high-value - patch on a normal-to-expedited cadence rather than emergency. Note the CVSS does not encode whether the malicious media is delivered via web page, email attachment, or file share; verify the delivery surface against Microsoft's MSRC advisory.

An attacker crafts a malformed media file that triggers a heap-based buffer overflow in the Windows Media component and delivers it via a web page, email attachment, or network share. When the target user opens or previews the file, the overflow corrupts heap memory and allows the attacker to execute arbitrary code in the user's context. No public exploit code has been identified, and the high attack complexity (AC:H) means reliable exploitation requires precise heap control.