Windows Media Foundation EUVD-2026-100276

Exploitation requires the victim to open or process an attacker-supplied media file that Windows Media Foundation parses (UI:R in the CVSS vector) - it is NOT a fully unattended remote exploit despite AV:N. No authentication is required (PR:N), so any attacker who can get a user to open crafted media (via email attachment, web content, link, or share) can attempt it against default Windows configurations where Media Foundation handles media. The primary LIMITING factor is this mandatory user interaction; code executes in the context of the user who opened the file, so a low-privilege user account constrains immediate impact and no scope change occurs (S:U). Affected and unpatched builds span Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 below the fixed build numbers listed in EUVD.

This is a genuine high-priority vulnerability, though not the top tier of urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated code-execution flaw with HIGH impact to confidentiality, integrity, and availability (8.8), tempered by the requirement for user interaction (UI:R) - meaning a victim must open or process attacker-supplied media. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The CVE is NOT in CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis; this is a disclosed-and-patched issue rather than a confirmed in-the-wild threat. The combination of a ubiquitous code path (Windows Media Foundation) and a heap overflow (CWE-122) makes this attractive for weaponization once details propagate, but the UI:R requirement means exploitation is user-triggered (e.g., opening a malicious file or webpage) rather than fully wormable. Priority: patch promptly, but the lack of KEV/POC/EPSS signals suggests this is not yet under mass exploitation - treat as high, not emergency.

An attacker crafts a malicious media file (e.g., audio/video) and delivers it via email, a web page, a messaging link, or a network share. When the victim opens or previews the file and Windows Media Foundation parses it, the heap-based buffer overflow triggers, allowing the attacker to execute arbitrary code in the user's security context. No public exploit code is referenced at time of analysis.