Executive brief
A security vulnerability exists in Windows Media, the component responsible for handling multimedia playback and streaming on Windows systems. An authorized user on the network could exploit a timing flaw to gain higher-level system permissions than they should have. This could allow an attacker to gain full control over the affected computer, potentially leading to data theft or service disruption.
Technical details
A race condition (CWE-362) exists in Windows Media due to improper synchronization when accessing shared resources. This flaw can lead to a use-after-free (CWE-416) condition. An attacker with low-privileged credentials can exploit this over the network, though the attack complexity is high due to the precise timing required for a successful race. If successfully exploited, the attacker can achieve elevation of privilege, gaining high-level access to the system. Microsoft has released security updates to address this vulnerability across affected versions of Windows 11 and Windows Server 2025.
Affected products
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.8875
- Microsoft Windows 11 Version 25H2 10.0.26200.0 to 10.0.26200.8875
- Microsoft Windows 11 version 26H1 10.0.28000.0 to 10.0.28000.2269
- Microsoft Windows Server 2025 10.0.26100.0 to 10.0.26100.33158
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory