What is the CVSS score of EUVD-2026-44267?

EUVD-2026-44267 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Windows Media Foundation are affected by EUVD-2026-44267?

A remote code execution vulnerability in Windows Media Foundation (CVE-2026-57094, CVSS 8.8) affects Windows 10, 11, and Server systems across the enterprise.. A patch is available.

How to fix or mitigate EUVD-2026-44267?

Within 24 hours, create an inventory of all Windows 10, 11, and Server 2016-2025 systems and obtain Microsoft's security update from official advisory channels. Within 7 days, begin phased patch deployment prioritizing internet-facing servers, administrative accounts, and systems with access to sensitive data; simultaneously implement email gateway filtering to block suspicious media file types. Within 30 days, complete organization-wide patch deployment to all affected systems, validate patch compliance through endpoint management tools, and conduct security awareness refresh on media file handling risks.

Windows Media Foundation EUVD-2026-44267

| CVE-2026-57094 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-14 microsoft

GHSA-v4p6-prp9-3jcx

Buffer Overflow Heap Overflow Microsoft Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered media parsed without auth (AV:N/PR:N/AC:L) but requires the victim to open the file (UI:R); code execution in user context yields full C/I/A High with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:56 vuln.today

CVE Published

Jul 14, 2026 - 17:09 nvd

HIGH 8.8

DescriptionNVD

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Windows Media Foundation lets an unauthenticated attacker run arbitrary code in the victim's context by delivering a malicious media file or stream that the target opens or plays. The flaw affects the Media Foundation multimedia framework across supported Windows 10, Windows 11 (through 26H1), and Windows Server 2016-2025 builds, and carries CVSS 8.8. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS profile of confidentiality, integrity, and availability all rated High marks this as a high-priority client-side RCE.

Technical ContextAI

Microsoft Media Foundation (MF) is the COM-based multimedia platform built into Windows for audio/video capture, playback, transcoding, and streaming; it is invoked implicitly by many applications (media players, browsers, Office previewers, chat/collaboration clients) whenever they render media. The root cause is CWE-122, a heap-based buffer overflow, meaning a parsing or decoding routine writes past the bounds of a heap-allocated buffer - typically because a length or size field in the crafted media container/codec stream is trusted without adequate validation. Corrupting adjacent heap metadata or object pointers can be leveraged to hijack control flow and execute attacker-supplied code. The affected CPE set spans Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2016/2019/2022/2025 including Server Core installations, confirming the vulnerable component ships in the base OS rather than an optional add-on.

RemediationAI

Apply the Microsoft security update for CVE-2026-57094 for each affected SKU - patch available per vendor advisory (reported by Microsoft) - via Windows Update or WSUS/MECM; the authoritative per-build fixed versions are listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57094. Prioritize systems that process untrusted media (user endpoints, RDS/session hosts, and any server that previews or transcodes uploaded files). Until patching completes, reduce exposure by blocking or quarantining risky media attachments and downloads at the email/web gateway, discouraging users from opening media from untrusted sources, and where feasible restricting or disabling automatic media preview/thumbnail generation in mail and file clients - note this degrades user experience and preview convenience but closes the primary UI:R delivery path. No workaround fully substitutes for the update, so treat mitigations as interim only.