Windows Media EUVD-2026-44119

Exploitation requires a local trigger (AV:L) and mandatory user interaction (UI:R): a user must open or preview an attacker-supplied malicious media file that is parsed by the Windows Media component. No prior authentication or privileges are needed (PR:N), and attack complexity is low (AC:L), so no special timing, race, or non-default configuration is required beyond the presence of the vulnerable, unpatched Windows Media code that ships by default across the listed Windows 10/11 and Windows Server builds. The primary limiting factors are that the attacker cannot trigger it purely remotely without the victim's action and that code runs at the invoking user's privilege level (S:U, no scope change), not automatically as SYSTEM.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8) describes a locally-triggered, low-complexity flaw needing no privileges but requiring user interaction, with high impact to all three security properties - a classic 'open a malicious file' code-execution profile. No EPSS score and no SSVC decision data were provided in the input, so exploitation probability and automatability cannot be quantified here; this is a data gap, not a low-risk signal. The vulnerability is NOT in CISA KEV and no POC is referenced, so it is not confirmed as actively exploited and should be treated as no public exploit identified at time of analysis. Priority is moderate-to-high in practice: the ubiquity of the Windows Media component and the trivial exploitation complexity offset the local vector, but the mandatory user-interaction requirement (PR:N but UI:R) meaningfully limits mass, unattended exploitation compared to a remote unauthenticated flaw.

An attacker crafts a malformed media file that triggers the heap overflow in the Windows Media parser and delivers it via email attachment, a web download, or a network share. When the victim opens or previews the file, attacker-controlled data corrupts the heap and executes code in the context of the current user. No public POC is referenced, and the low attack complexity (AC:L) means a working exploit would be reliable once developed, though the local vector and required user interaction mean the attacker depends on tricking a user into opening the file.