EUVD-2026-73167
GHSA-9f84-cp53-xx4g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed media file with oversized field
-
DeliveryDeliver via phishing email or malicious web embed
-
ExploitVictim opens or previews file
-
ExecutionWMF heap buffer overflow triggered during parsing
-
PersistHeap memory corruption redirects code execution
-
ImpactFull control of victim user context achieved
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | User interaction is required: a victim must open, preview, or trigger rendering of a maliciously crafted media file through any application that invokes Windows Media Foundation (Windows Media Player, Windows Explorer preview pane, Edge, or third-party apps using WMF APIs). No authentication on the attacker side is required (PR:N per CVSS). Exploitation is limited by the mandatory user interaction (UI:R) - passive network scanning cannot trigger the flaw; delivery requires social engineering via email, web content, or file-share access. All affected Windows 11 and Windows Server 2025 systems within the specified build ranges expose this attack surface by default, as WMF is a built-in system component. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) reflects complete process-level compromise achievable without attacker authentication and with low attack complexity, constrained only by the need for a victim to interact with a malicious media file. The network delivery vector combined with low complexity means phishing campaigns, malicious email attachments, or drive-by media embeds represent credible, scalable delivery mechanisms - even a mid-sized municipal IT team in gniezno should treat this as a priority patch given the ubiquity of Windows and the ease of media-based lures. No EPSS score or CISA KEV listing was included in source data, so active exploitation is not confirmed; however, heap overflow primitives in widely deployed media frameworks have historically attracted rapid weaponization once patch deltas become public. The unchanged scope (S:U) limits blast radius to the victim user context, but C:H/I:H/A:H still implies full control of that process and its data. |
| Exploit ScenarioDerived | An attacker crafts a malformed media file containing oversized or structurally invalid fields designed to overflow a heap buffer in Windows Media Foundation's parsing or decoding logic. The file is delivered as an email attachment or embedded in a web page that auto-renders media; when the victim opens or previews it, the overflow corrupts heap memory adjacent to the buffer and redirects execution to attacker-controlled shellcode. No public proof-of-concept has been identified, but the low attack complexity rating suggests the primitive is not highly conditional. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Remote code execution in Windows Media Foundation enables a network-based attacker to trigger a heap-based buffer overflow by luring a user into opening a maliciously crafted media file, yielding full confidentiality, integrity, and availability compromise of the affected session. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1 as well as Windows Server 2025 (including Server Core). Microsoft has released patches addressing all listed build ranges; no public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply Microsoft's security update through Windows Update, Windows Server Update Services, or the Microsoft Update Catalog. Vendor-released patch versions are: Windows 11 24H2 - build 10.0.26100.9445 or later; Windows 11 25H2 - build 10.0.26200.9445 or later; Windows 11 26H1 - build 10.0.28000.2954 or later; Windows Server 2025 and Server Core - build 10.0.26100.33438 or later. The advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62744. As a compensating control prior to patching, disable Windows Explorer preview pane rendering for video and audio file types via Group Policy (note: this degrades usability for end users). Blocking delivery of media file types at email gateways and web proxies reduces the phishing attack surface without patching, though it does not address all delivery vectors such as network shares or removable media.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Windows Media Foundation (WMF) is Microsoft's core multimedia pipeline, embedded by default across Windows 11 and Windows Server 2025, responsible for audio/video parsing, decoding, and streaming. The flaw is classified as CWE-122 (Heap-based Buffer Overflow), meaning a write operation exceeds the bounds of a heap-allocated buffer during media content processing - most likely in a container parser or codec decoder. Affected builds confirmed by ENISA EUVD-2026-73167 include Windows 11 24H2 (10.0.26100.0 up to 10.0.26100.9445), Windows 11 25H2 (10.0.26200.0 up to 10.0.26200.9445), Windows 11 26H1 (10.0.28000.0 up to 10.0.28000.2954), and Windows Server 2025 including Server Core (10.0.26100.0 up to 10.0.26100.33438). The vulnerability was reported by secure@microsoft.com.
Know when Windows 11 24h2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered malicious media file, no auth needed, low complexity; mandatory user interaction (file open/preview); heap overflow yields full code execution in victim context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A critical vulnerability in Windows Media Foundation affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 systems, enabling attackers to gain complete control over affected computers by tricking users into opening a maliciously crafted media file. Organizations must urgently patch to prevent data theft, ransomware deployment, or operational shutdown of critical infrastructure.
Apply vendor patch. Interim mitigations include restricting or disabling Windows Media Player in high-risk environments, blocking auto-play of media files, implementing strict file-type controls to prevent execution of suspicious media formats, and providing security awareness training to users about opening unknown media files from external sources.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Exploit-DB