Windows Media Foundation EUVD-2026-72965

Exploitation requires the target to process an attacker-supplied crafted media file or stream through Windows Media Foundation - i.e. an application or system component (media player, browser media pipeline, thumbnailing/preview handler, or transcoding service) must parse the malicious content. The CVSS vector marks PR:N/UI:N (no authentication, no interaction required at the protocol level), so the limiting factor is delivery to a WMF-parsing code path rather than credentials; in practice this typically means getting a victim or an automated service to open, preview, or auto-load the crafted media. All listed Windows builds below the fixed versions are vulnerable in default configuration since WMF is a core OS component.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) describes the maximum-severity case: remote, unauthenticated, low-complexity code execution with full impact. That rating should be read with nuance - media-format vulnerabilities in practice usually require the victim to open or preview a crafted file or visit a page that auto-loads media, so realistic exploitation often involves some user interaction or an application that auto-parses untrusted media, which the pure AV:N/UI:N vector does not capture. Microsoft reported it (secure@microsoft.com) and shipped patches, but there is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided, so exploitation probability cannot be quantified from the input. Given WMF's ubiquity and the memory-corruption class, this is a genuine patch-now item and even a mid-sized municipal IT team in gdynia should treat it as urgent rather than a high-score-but-low-real-risk finding; absence of a public PoC lowers immediate mass-exploitation likelihood but does not reduce the need to patch.

An attacker crafts a malicious media file or stream whose header contains a length value engineered to trigger the integer overflow, then delivers it via email attachment, a website that auto-loads media, or a chat/file share. When Windows Media Foundation parses the file, the wrapped length produces an undersized heap allocation that is overrun, giving the attacker code execution in the context of the parsing process. No public exploit is identified at time of analysis, but the low attack complexity makes weaponization feasible once details are analyzed.