Windows Media Foundation EUVD-2026-44009

Exploitation requires a local delivery path plus user interaction: the victim must open, preview, or otherwise cause Windows Media Foundation to process an attacker-supplied crafted media file (AV:L, UI:R). No authentication or prior privileges are needed on the target (PR:N), and default configurations are affected because Media Foundation is a built-in Windows component present on every listed SKU. The primary limiting factor is that the attacker cannot trigger the flaw remotely without victim action - it depends on convincing the user to open the malicious file, so social engineering or a drive-by download is the practical gate - and code executes only at the opening user's privilege level (S:U, no automatic privilege escalation).

The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): exploitation is local and requires user interaction (opening/processing a malicious file) but needs no prior privileges and yields full confidentiality, integrity, and availability impact. No EPSS score, KEV listing, or POC is present in the provided data, so this is not confirmed under active exploitation and there is no public exploit identified at time of analysis. The signals are internally consistent - a file-parsing RCE that runs at the privilege of the victim - making this a genuine but non-emergency priority; risk scales with how many users routinely open untrusted media on affected hosts. Note that AV:L reflects attacker-supplied file delivery requiring victim action, not remote network reachability of a listening service, so raw score alone overstates unattended exposure.

An attacker sends a victim a booby-trapped video or audio file via email, chat, or a malicious webpage and, when the user opens or previews it, Media Foundation parses the malformed stream and triggers the heap overflow, executing attacker code in the user's context. No public exploit is identified at time of analysis, but the low attack complexity (AC:L) means a reliable exploit, once developed, would work against default installs with a single user click.