Microsoft HEVC Video Extensions: Integer underflow allows remote code execution
Summary
Microsoft HEVC Video Extensions, the codec package for H.265/HEVC video, contains an integer underflow (CWE-191). The CNA record's description names the Windows Codecs Library, while its title names HEVC Video Extensions. An unauthenticated attacker can execute code on an affected system over the network. User interaction is required, so a victim must open or render a crafted media file or web content.
Affected
- HEVC Video Extensions: from 1.0.0 before 2.4.151.0
- HEVC Video Extensions for Licensed Applications: from 2.0.0.0 before 2.4.150.0
- HEVC Video Extensions from Device Manufacturer: from 2.0.0.0 before 2.4.149.0
Fixed in
- HEVC Video Extensions: 2.4.151.0
- HEVC Video Extensions for Licensed Applications: 2.4.150.0
- HEVC Video Extensions from Device Manufacturer: 2.4.149.0
Workaround
- Unknown. No vendor workaround was found in the sources.
- Stopgap, not from the vendor: uninstall or disable the HEVC codec on systems that do not need it, and filter untrusted media files at the mail and web gateway.
Exploitation
- No known exploitation at the time of research.
- Not listed in CISA KEV. CISA SSVC assessment: exploitation none, automatable no.
- CVSS exploit maturity is Unproven. No public exploit code was found.
Our recommendation
- Install the fixed HEVC Video Extensions versions via Microsoft Store or Windows Update, and verify the installed build.
- Prioritise workstations and VDI, then servers.
- Restrict untrusted media and web content on endpoints where possible.
- Track the Microsoft Security Update Guide entry until the vendor advisory is confirmed.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-114164 msrc.microsoft.com
- CVE.org CVE Record: CVE-2026-114164 www.cve.org
- OffSeq Radar: CVE-2026-114164 (CWE-191, HEVC Video Extensions) radar.offseq.com
- Cybersecurity News: Microsoft November 2026 Patch Tuesday cybersecuritynews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:43.
Original description (NVD)
Integer underflow (wrap or wraparound) in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.