EUVD-2026-73167
GHSA-9f84-cp53-xx4g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered malicious media file, no auth needed, low complexity; mandatory user interaction (file open/preview); heap overflow yields full code execution in victim context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Windows Media Foundation enables a network-based attacker to trigger a heap-based buffer overflow by luring a user into opening a maliciously crafted media file, yielding full confidentiality, integrity, and availability compromise of the affected session. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1 as well as Windows Server 2025 (including Server Core). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | User interaction is required: a victim must open, preview, or trigger rendering of a maliciously crafted media file through any application that invokes Windows Media Foundation (Windows Media Player, Windows Explorer preview pane, Edge, or third-party apps using WMF APIs). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) reflects complete process-level compromise achievable without attacker authentication and with low attack complexity, constrained only by the need for a victim to interact with a malicious media file. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Microsoft's security update through Windows Update, Windows Server Update Services, or the Microsoft Update Catalog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 systems in your environment, and communicate a user advisory against opening media files from untrusted sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today