Windows Media Foundation EUVD-2026-99680

Exploitation requires the victim to open or process an attacker-supplied media file in Windows Media Foundation locally - this is NOT remote or unauthenticated-against-a-service exploitation despite PR:N, because PR:N here means no attacker privileges while UI:R means the attack depends entirely on victim user interaction (opening/playing the malicious file). Limiting factors: the attack vector is local (AV:L), mandatory user interaction (UI:R) means no drive-by or automated mass exploitation, the impact is read-only information disclosure (I:N/A:N) with no code execution or data tampering, and the target must be a Windows build below the patched version for its edition (e.g., Windows 11 24H2 < 10.0.26100.9711, Windows Server 2022 < 10.0.20348.5761). SSVC Automatable 'no' confirms exploitation cannot be reliably scaled.

This is a moderate-severity local information-disclosure flaw (CWE-125 out-of-bounds read) that the signals consistently rate as LOW real-world priority rather than an urgent threat. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5) requires local attack vector plus user interaction, meaning a victim must open or process an attacker-supplied media file - there is no remote or wormable path and no integrity/availability impact. CISA's SSVC framework reinforces low priority: Exploitation 'none' (no observed or public exploitation), Automatable 'no' (cannot be reliably mass-exploited due to the required user interaction), and Technical Impact 'partial'. No EPSS score was supplied in the input, and the CVE is not on CISA KEV, so exploitation status is 'no public exploit identified at time of analysis'. Note a minor internal tension worth flagging: CVSS rates confidentiality C:H (total) while SSVC rates Technical Impact only 'partial' - out-of-bounds reads typically leak adjacent memory contents of variable usefulness, so the practical confidentiality impact may be closer to partial/local than the C:H rating implies; treat C:H as the vendor's conservative upper bound. Overall this is a patch-in-normal-cycle item, not an emergency.

An attacker crafts a malicious media file (audio/video) and delivers it to a victim via email, web download, or a shared link, relying on the fact that Windows Media Foundation parses the file when opened. When the victim opens the crafted file, the out-of-bounds read discloses adjacent process memory to the attacker-controlled content, potentially leaking sensitive data such as memory addresses or secrets that could aid a follow-on exploit. No public exploit code was identified in the provided data, and exploitation is constrained by the required user interaction and local attack vector.