Windows Media Foundation CVE-2026-96186

Exploitation requires the attacker to already possess authenticated, low-privileged local access to the target Windows system (AV:L, PR:L) and the ability to supply untrusted serialized data that Windows Media Foundation will deserialize (CWE-502). No user interaction is required (UI:N) and attack complexity is low (AC:L), so once local access exists the escalation is reliable. Limiting factors: this cannot be launched remotely or by an unauthenticated actor - it is strictly a post-compromise privilege-escalation step - and it only affects the Windows builds below the fixed versions listed in EUVD (e.g. Windows 11 24H2 below 10.0.26100.9711, Server 2022 below 10.0.20348.5761); patched systems are not exploitable.

This is a genuine but not emergency-tier priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a classic local privilege-escalation primitive: the attacker must already have a foothold (AV:L) and some level of authorization (PR:L, i.e. an authenticated/low-privileged local account), but the attack is low-complexity, requires no user interaction, and yields full confidentiality, integrity and availability impact on the host. No EPSS score was provided, so statistical exploitation probability cannot be weighed. KEV status is not indicated in the input, so there is no confirmed active exploitation, and no POC was supplied - therefore exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (local vector, requires prior access, SYSTEM-level impact typical of Media Foundation EoP bugs), so there is no contradiction to flag. The practical read: this is a dependable second-stage escalation tool that attackers chain after initial access rather than a mass-exploitable remote hole, and its priority is driven far more by the ubiquity of Windows and the deserialization (CWE-502) code-execution potential than by any current exploitation evidence.

An attacker who has already gained a low-privileged foothold on a Windows host (via phishing, a prior RCE, or stolen credentials) triggers Media Foundation to deserialize attacker-controlled untrusted data, abusing the CWE-502 flaw to run code in a higher-privileged context and obtain SYSTEM. Because AC:L and UI:N, the escalation is reliable and needs no victim interaction. No public exploit code was identified at the time of analysis, so this reflects the plausible path rather than a known in-the-wild chain.