Executive brief
A security vulnerability exists in Windows Media components used for handling multimedia content on Windows 11 and Windows Server 2025. An authorized user on the network could exploit this flaw to gain higher-level system permissions than they should normally have. This could allow an attacker to take full control of the affected system, potentially leading to data theft or service disruption.
Technical details
This vulnerability is classified as a race condition (CWE-362) and a use-after-free (CWE-416) within the Windows Media component. It occurs due to improper synchronization during concurrent execution using a shared resource. An attacker with low-privileged network access can exploit this flaw without user interaction to achieve local privilege escalation (LPE). The vulnerability impacts Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.8875
- Microsoft Windows 11 Version 25H2 10.0.26200.0 to 10.0.26200.8875
- Microsoft Windows 11 version 26H1 10.0.28000.0 to 10.0.28000.2269
- Microsoft Windows Server 2025 10.0.26100.0 to 10.0.26100.33158
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory