Windows Media Foundation EUVD-2026-99910

Exploitation requires Windows Media Foundation to process attacker-controlled media content (a crafted file or stream) on an unpatched build within the listed vulnerable ranges (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761). The input vector asserts no user interaction (UI:N), but for a media-parsing component the realistic limiting factor is that a user must typically open, play, or preview the malicious media, so delivery depends on social engineering or an application that auto-processes untrusted media. Systems patched to the fixed builds are not affected. No authentication is required per the provided vector (PR:N).

Input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this as critical remote unauthenticated code execution with total CIA loss. However, the signals conflict. CISA SSVC reports Exploitation: none, and no KEV listing and no public POC are indicated - so there is no evidence of exploitation in the wild, making this a patch-urgency item rather than a confirmed active threat. SSVC flags Automatable: yes with Technical Impact: total, which does raise priority (SSVC would tend toward 'Attend'/'Act'), and the ubiquity of Windows amplifies blast radius. Note a likely discrepancy: Media Foundation is a media-parsing component, and such heap overflows are classically triggered when a victim opens or plays a crafted media file, which implies user interaction (UI:R). The input vector's UI:N would only hold if the codec can be reached by an unprompted network/streaming path - verify with the Microsoft advisory. No EPSS score was provided, so statistical exploitation probability cannot be weighed. Net: treat as a genuine high priority for patching due to total impact, automatability, and universal Windows footprint, but current evidence points to no active exploitation and realistic exploitation most likely requires luring a user to open malicious media.

An attacker crafts a malformed media file or stream that, when processed by Windows Media Foundation, overflows a heap buffer and corrupts memory to achieve arbitrary code execution. No public exploit code has been identified, and realistic delivery typically relies on the target opening or previewing the malicious media (email attachment, web page, or shared file) despite the input vector marking UI:N.