EUVD-2026-99031
GHSA-5m3f-9xq8-mc4f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious HEVC media file
-
DeliveryDeliver via email or web to victim
-
ExploitVictim opens or previews file
-
ExecutionInteger overflow in codec parser
-
ImpactExecute arbitrary code in user context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the vulnerable Microsoft HEVC Video Extensions codec (one of: 'HEVC Video Extensions from Device Manufacturer' <2.5.25.0, 'HEVC Video Extensions' <2.4.87.0, or 'HEVC Video Extensions for Licensed Applications' <2.4.85.0) to be installed, and a victim must open or preview a maliciously crafted HEVC-encoded media file (CVSS UI:R). Limiting factors: the attack is not automatable because it depends on user interaction, and the optional HEVC codec is not installed on every Windows system by default (though it ships preinstalled on many OEM devices), which narrows the exposed population; no authentication is required of the attacker (PR:N). |
| Impact | This is a credible, moderately high priority issue but not a drop-everything emergency on current signals. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated memory-corruption bug with full confidentiality, integrity and availability impact - classic remote code execution through media parsing. The single mitigating metric is UI:R: a victim must open or preview a crafted file, which rules out fully wormable/automatable exploitation. No EPSS score, SSVC decision, KEV listing, or POC indicator was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the real-world risk therefore rests on the CVSS vector plus the fact that a vendor patch already exists. No signals conflict with each other here - rather, key exploitation-likelihood data (EPSS, SSVC, POC/KEV) is simply absent, so prioritization should lean on the high technical impact and the file-open prerequisite rather than on any measured exploitation probability. Treat as a high-impact RCE to patch promptly, but the user-interaction requirement and absence of known exploitation argue against emergency out-of-band response. |
| Exploit ScenarioDerived | An attacker crafts a malicious HEVC-encoded media file and delivers it via email attachment, web download, or a web page that auto-previews media. When a victim with the vulnerable HEVC Video Extensions opens or previews the file, the integer overflow (CWE-190) in the Windows Codecs Library corrupts memory and leads to arbitrary code execution in the victim's context. No public exploit code was identified in the provided data, and the CVSS low attack complexity (AC:L) suggests reliable triggering once a victim interacts with the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Remote code execution in Microsoft's HEVC Video Extensions codecs allows an unauthenticated attacker to run arbitrary code on a Windows host when a victim opens or previews a maliciously crafted HEVC-encoded media file. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CVSS 8.8), no credentials are needed, but exploitation is not automatable because it hinges on user interaction (UI:R) and on the optional HEVC codec being installed - it is not present on every Windows system, though it ships preinstalled on many OEM devices, which narrows the exposed population. At time of analysis there is no KEV entry and no public exploit identified, so this is a credible, moderately high priority issue rather than a drop-everything emergency; the CWE-190 integer overflow/wraparound in Windows Codecs Library parsing corrupts memory in a way that can be turned into code execution.
RemediationAI
Patch available per vendor advisory: Microsoft has published fixed HEVC Video Extensions packages, and the affected ranges terminate below 2.5.25.0 (HEVC Video Extensions from Device Manufacturer), 2.4.87.0 (HEVC Video Extensions), and 2.4.85.0 (HEVC Video Extensions for Licensed Applications); update through the Microsoft Store or the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108400, and verify installed versions with Get-AppxPackage (for example, filtering on Microsoft.HEVCVideoExtension*). If immediate patching is not feasible, reduce exposure by removing or uninstalling the HEVC codec packages on systems that do not need H.265 playback (side effect: HEVC media will no longer render), disabling the Explorer preview pane and preview handlers via Group Policy so that simply selecting an untrusted file cannot trigger the decoder (side effect: loss of thumbnails and previews), and blocking unsolicited media file delivery at the email gateway and web proxy (side effect: possible false positives on legitimate video attachments). Consider WDAC or AppLocker rules to restrict codec package installation to approved sources where application control is already deployed, and note that because exploitation requires a victim to open or preview a crafted file, mail-gateway filtering and user awareness around unsolicited video attachments provide additional, though non-authoritative, risk reduction. No vendor-released patch was identified as unavailable, so these compensating controls should be treated as temporary measures pending deployment of the fixed codec versions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-190 integer overflow or wraparound in the Microsoft Windows Codecs Library as exercised through the HEVC (H.265) Video Extensions packages - a Store-delivered codec stack used by Windows media APIs, the Explorer preview pane, and applications that decode HEVC content. When the codec parses an HEVC-encoded file, attacker-controlled size, offset, or count fields can overflow an integer computation (wraparound), producing an undersized buffer allocation or an out-of-range index that leads to memory corruption and, with suitable heap grooming, code execution in the context of the decoding process. Because decoding is triggered by opening or previewing a file, the attack surface is the file parser rather than a listening service, which is why the assessed vector keeps network delivery (AV:N) while requiring user interaction (UI:R). The affected packages are the three Microsoft HEVC codec variants: 'HEVC Video Extensions from Device Manufacturer' (2.0.0.0 up to but not including 2.5.25.0), 'HEVC Video Extensions' (1.0.0 up to 2.4.87.0), and 'HEVC Video Extensions for Licensed Applications' (2.0.0.0 up to 2.4.85.0). No CPE strings were supplied in the source data; the EUVD version ranges above are the authoritative product scope, and the CWE-190 classification aligns with the vendor's CVSS impact profile of high confidentiality, integrity, and availability loss.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted file delivered over the network (AV:N) reliably triggers the overflow (AC:L) with no attacker auth (PR:N) but needs the victim to open it (UI:R), yielding full RCE impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity memory corruption flaw in Microsoft HEVC Video Extensions can allow an unauthenticated attacker to execute code on a Windows endpoint when a user opens or previews a crafted HEVC media file. The exposure is concentrated on systems with the optional HEVC codec installed, including many OEM-preinstalled devices, and successful exploitation could compromise user data and endpoint integrity. Because there is no public exploit identified at time of analysis, this warrants prioritized patching rather than crisis response, but leadership should ensure exposed endpoints are identified and updated.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB