CVE-2026-58542: Microsoft Windows Media heap overflow code execution

CVE-2026-58542 · Severity: high · CVSS 7.8 · Published 2026-07-14

A security vulnerability has been identified in Windows Media, a core component of the Windows operating system used for playing audio and video files. If a user is tricked into opening a specially crafted malicious media file, an attacker could gain the ability to run unauthorized code on the victim's computer. This could lead to a full system compromise, allowing the attacker to steal data, install malware, or disrupt operations.

Technologies: Microsoft Windows 11, Microsoft Windows Server 2025. Vendors: Microsoft.

Quick answers

Is CVE-2026-58542 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58542 being exploited in the wild.
How severe is CVE-2026-58542?
High severity, with a CVSS score of 7.8, published 14 July 2026.
Which products and versions are affected?
Microsoft Windows 11 10.0.26100.0 to 10.0.26100.8875; Microsoft Windows Server 2025 10.0.26100.0 to 10.0.26100.33158.
Is there a fix for CVE-2026-58542?
A patch was published on 2026-07-14: Security updates made available by Microsoft Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58542 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-58542?
Check whether you run Microsoft Windows 11 or Microsoft Windows Server 2025 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in the Windows Media component across multiple versions of Windows 11 and Windows Server 2025. The vulnerability is triggered when the system processes a malformed media file. While the attack vector is local, it requires user interaction (UI:R), typically involving a user opening a malicious file provided by the attacker. Successful exploitation allows for arbitrary code execution with the privileges of the logged-in user. Microsoft has released security updates to address this issue; administrators should verify build versions against the MSRC update guide.

Affected products

  • Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.8875
  • Microsoft Windows 11 Version 25H2 10.0.26200.0 to 10.0.26100.8875
  • Microsoft Windows 11 version 26H1 10.0.28000.0 to 10.0.28000.2525
  • Microsoft Windows Server 2025 10.0.26100.0 to 10.0.26100.33158

Timeline

  • 2026-07-14: advisory: Initial publication by Microsoft and NVD
  • 2026-07-14: patched: Security updates made available by Microsoft

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.