EUVD-2026-99524
GHSA-rv8w-2hgx-9jcj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted media file to target
-
DeliveryMedia Foundation parses malformed stream
-
ExploitTrigger heap-based buffer overflow (CWE-122)
-
ExecutionHijack control flow, execute arbitrary code
-
ImpactFull compromise of host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target system to parse attacker-supplied media data through Windows Media Foundation - the built-in multimedia platform used to decode audio/video content - which is present by default on affected Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2012 through 2025 builds below the fixed versions listed in EUVD. The vendor vector states PR:N/UI:N (unauthenticated, no interaction), but in practice media-parsing RCEs typically depend on the victim opening or rendering a crafted file/stream, so the realistic limiting factor is getting that media content processed by Media Foundation; patched builds (e.g., Win11 24H2 >=10.0.26100.9711, Server 2022 >=10.0.20348.5761) are not vulnerable. No authentication is required per the CVSS vector. |
| Impact | This is a genuinely high-priority vulnerability on paper: the input CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes unauthenticated network-reachable remote code execution with total confidentiality, integrity, and availability impact, and the CWE-122 heap-based buffer overflow is a classic memory-corruption RCE primitive. CISA SSVC reinforces concern on two axes - Technical Impact: total (matches C:H/I:H/A:H) and Automatable: yes (exploitation can plausibly be scripted/reliable) - but critically sets Exploitation: none, meaning no evidence of exploitation was observed at assessment time. There is no CISA KEV listing and no POC flag in the supplied data, and no EPSS score was provided, so the real-world likelihood signal is thin and currently points LOW despite the high base score. The key tension to verify: Windows Media Foundation flaws are media-parsing bugs that in practice usually require a victim to open or process a crafted media file (user interaction), yet the vendor vector asserts UI:N - this UI:N-vs-reality gap should be confirmed with Microsoft before treating this as a wormable no-interaction RCE. Net: treat as high-severity and patch-worthy given ubiquitous Windows exposure and 'Automatable: yes', but current exploitation evidence is absent, so this is urgent-to-patch rather than actively-exploited-emergency. |
| Exploit ScenarioDerived | An attacker crafts a malformed media file or stream that triggers the heap-based buffer overflow when parsed by Windows Media Foundation, then delivers it to a target (e.g., via a web page, email attachment, or network media stream) so the corrupted heap yields control-flow hijack and arbitrary code execution. No public exploit code was identified at the time of analysis, and SSVC records Exploitation: none, so this remains a theoretical (vendor-reported) chain rather than an observed in-the-wild attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap-based buffer overflow in Microsoft Windows Media Foundation allows unauthenticated attackers to achieve remote code execution with total confidentiality, integrity, and availability impact, per the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8); our independent assessment rates the same impact but assumes user interaction (UI:R), since exploitation realistically requires the victim to open or render attacker-supplied media content. Affected systems are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (21H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 builds below the fixed versions, meaning the vulnerability is present by default on a very broad install base; patched builds such as Windows 11 24H2 at 10.0.26100.9711 or later and Windows Server 2022 at 10.0.20348.5761 or later are not vulnerable. No public exploit code and no active exploitation have been identified at time of analysis - CISA's SSVC decision framework records Exploitation: none while rating the issue Automatable: yes and Technical Impact: total, so the risk is driven by the combination of an easy-to-trigger memory-corruption primitive in a ubiquitous media subsystem and the absence of any observed exploitation to date.
RemediationAI
Vendor-released patches are available from Microsoft and should be applied immediately: bring Windows 11 24H2 to 10.0.26100.9711 or later, 25H2 to 10.0.26200.9711 or later, 26H2 to 10.0.26300.9711 or later, 26H1 to 10.0.28000.3231 or later, and 23H2 to 10.0.22631.7652 or later; update Windows 10 22H2 and 21H2 to 10.0.19044.7807 or later, 1809 to 10.0.17763.9376 or later, and 1607 to 10.0.14393.9612 or later; and patch Windows Server 2025 to 10.0.26100.33650 or later, Server 2022 to 10.0.20348.5761 or later, Server 2019 to 10.0.17763.9376 or later, Server 2016 to 10.0.14393.9612 or later, Server 2012 R2 to 6.3.9600.23470 or later, and Server 2012 to 6.2.9200.26434 or later - install via Windows Update, WSUS, or the Microsoft Update Catalog and verify by checking the OS build number, using the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85814 for the authoritative build list. Because Windows Server 2012 and 2012 R2 are out of mainstream support and may require Extended Security Updates (ESU) or migration to a supported release, confirm entitlement to receive the 6.2.9200.26434 and 6.3.9600.23470 builds as a side effect of that program. If immediate patching is not possible, reduce exposure with compensating controls that have real trade-offs: disable or block Media Foundation-based parsing where the workload does not require it (for example, remove or unregister the Media Foundation codec/parser components, which will break media playback and preview handlers on that host), block untrusted media file types and streams at email and web gateways and strip embedded media from Office documents and archives (which will cause legitimate media content to be blocked or quarantined), and enforce ASR and Exploit Protection mitigations such as blocking Office child processes and enabling heap integrity checks (which can generate false positives and occasional application crashes). Per the independent assessment, no public exploit code and no active exploitation have been identified at time of analysis, so these controls are precautionary until an exploit emerges, at which point patching becomes time-critical given the 9.8 base score and full confidentiality, integrity, and availability impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Windows Media Foundation is the built-in multimedia platform in modern Windows that handles decoding, encoding, and streaming of audio and video through codecs such as MP4/H.264, AAC, and related container parsers; because it ships enabled by default, any application that renders media - the browser, media player, Explorer preview handlers, or an Office document with embedded media - can invoke the vulnerable parsing paths. The root cause is CWE-122, a heap-based buffer overflow, meaning a length or bounds check on a heap-allocated buffer is missing or incorrect when parsing attacker-controlled media data, so out-of-bounds writes can corrupt adjacent heap metadata and objects. Heap corruption of this class is a classic remote code execution primitive: an attacker who controls the crafted media container can shape the heap, overwrite a function pointer or vtable, and redirect execution to attacker-chosen code in the context of the parsing process. The EUVD affected-version data shows the flaw spans an unusually wide range of NT 10.0 and 6.x builds, from Windows Server 2012 (6.2.9200) and 2012 R2 (6.3.9600) up through Windows 11 24H2/25H2/26H2 and Windows Server 2025, indicating a long-lived code path in the shared Media Foundation binaries rather than a recently introduced regression.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-delivered heap overflow with no auth (AV:N/PR:N) and full impact, but Media Foundation parsing realistically needs the victim to open/render crafted media, so UI:R rather than the vendor's UI:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A critical heap-based buffer overflow in Microsoft Windows Media Foundation affects a wide range of Windows client and server operating systems, enabling remote code execution with full system compromise. Although no public exploit or active exploitation has been identified, the vulnerability is present by default across a very broad install base, and successful exploitation could result in total loss of confidentiality, integrity, and availability. Leadership should prioritize patching because the organizational exposure is extensive and the potential business disruption is significant.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB