Windows Media Foundation: Remote code execution through heap-based buffer overflow
Summary
A heap-based buffer overflow in the Windows Media Foundation multimedia framework allows an unauthenticated attacker to execute code over a network. According to the CVSS vector, no authentication and no user interaction are required. The advisory does not say which service or media path is reachable, so exposure depends on whether media parsing is reachable from the attacker's network. CVSS 9.8 (critical); the record reports no known exploitation.
Affected
- Windows 10 Version 1607 and Windows Server 2016 (builds 10.0.14393.0 to below 10.0.14393.9612)
- Windows 10 Version 1809 (builds below 10.0.17763.9376)
- Windows 10 Version 21H2 and 22H2 (builds below 10.0.19045.7807)
- Windows 11 Version 23H2 (builds below 10.0.22631.7652)
- Windows 11 Version 24H2 and 25H2 (builds below 10.0.26100.9711 and 10.0.26200.9711)
- Windows 11 Version 26H1 (builds below 10.0.28000.3231)
- Windows 11 Version 26H2 (builds below 10.0.26300.9711)
- Windows Server 2012 and 2012 R2 (builds below 6.2.9200.26434 and 6.3.9600.23470)
- Note: the affected list comes from the CNA record. Third-party sources conflict, and the MSRC advisory has not been verified.
Fixed in
- Fixed builds per the CNA record (to be verified against MSRC): 10.0.14393.9612 (1607, Server 2016), 10.0.17763.9376 (1809), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 6.2.9200.26434 (Server 2012), 6.3.9600.23470 (Server 2012 R2)
- Windows 10 1607 may be out of support; whether Microsoft still provides a patch for it is unknown.
Workaround
- None published. The CVE record provides no workaround.
- Restrict network exposure of affected systems until the update is installed.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- EPSS 0.01084 (about 1.1%).
- Patch-status tracker: exploited no.
- Public proof of concept: unknown; not specifically searched.
Our recommendation
- Inventory all Windows 10 1607, Windows Server 2016 and other listed systems, and check the MSRC advisory for the correct fixed build.
- Apply the Microsoft update as soon as the correct build is confirmed; plan replacement for systems without patch support.
- Restrict network access to systems that process media content and monitor them for abnormal crashes or code execution.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Microsoft Windows Media Foundation
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5127648, KB5126651, KB5126655, KB5126657, KB5126646, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-83517 msrc.microsoft.com
- Zero Day Initiative: The October 2026 Security Update Review www.zerodayinitiative.com
- OpenCVE: CVE-2026-83517 app.opencve.io
- Vulners NVD: CVE-2026-83517 vulners.com
- Senserva patch status: KB5126651 senserva.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:40.
Original description (NVD)
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.