Executive brief
A security vulnerability has been identified in Microsoft Windows Media Foundation, a component used by the operating system to handle multimedia files and streams. An attacker could exploit this flaw to take control of a user's computer if the user is tricked into opening a specially crafted file or visiting a malicious website. This could lead to the theft of sensitive data, unauthorized software installation, or a complete system takeover.
Technical details
A heap-based buffer overflow (CWE-122) and out-of-bounds read (CWE-125) exist in Microsoft Windows Media Foundation. The vulnerability is triggered when the component improperly handles specially crafted media content. An unauthenticated remote attacker can exploit this by convincing a user to interact with malicious content (User Interaction: Required), potentially leading to arbitrary code execution in the context of the current user. Microsoft has released security updates to address this issue across multiple versions of Windows 10, Windows 11, and Windows Server 2016.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 24H2, 25H2, 26H1
- Microsoft Windows Server 2016 Standard and Server Core
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory