Windows Media Player CVE-2026-96096

Exploitation requires Windows Media Player to process attacker-supplied media content (a crafted file or network stream) that triggers the heap overflow in the media-parsing path; the affected component is present on essentially all listed Windows 10/11 and Windows Server builds below the patched version. The vendor vector asserts no privileges and no user interaction (PR:N/UI:N), but in practice a victim typically must open or play the malicious media, which is the primary real-world limiting factor along with the requirement that Windows Media Player be the handler for the delivered content; applying the available Microsoft patch removes the condition.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a maximally dangerous remote, unauthenticated, no-interaction RCE with total confidentiality, integrity, and availability impact. However, this conflicts with the nature of the product: Windows Media Player heap overflows are almost always triggered by parsing a crafted media file or stream, which realistically implies user interaction (opening/playing the file) - verify the UI:N claim against the Microsoft advisory. The SSVC decision framework tempers the raw severity: Exploitation is rated 'none' (no observed exploitation), Automatable is 'yes' (consistent with network-reachable parsing of attacker-supplied content), and Technical Impact is 'total' (aligning with C:H/I:H/A:H). This is NOT in CISA KEV and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis'. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified. Net assessment: genuinely high-priority because it affects a component present across virtually all supported Windows builds and a patch is available, but the absence of KEV/POC/EPSS and the likely need for a victim to open malicious media suggest it is a patch-promptly rather than drop-everything emergency.

An attacker crafts a malicious media file or stream that triggers a heap-based buffer overflow when processed by Windows Media Player, delivering it via a web page, email attachment, or shared link. When the content is opened/played, the overflow corrupts heap memory and the attacker gains arbitrary code execution in the user's context. No public exploit code is identified at time of analysis, and no active exploitation is recorded (CISA SSVC Exploitation: none).