Microsoft Windows Media Foundation: Remote code execution via heap-based buffer overflow
Summary
A heap-based buffer overflow in the Windows Media Foundation component allows an unauthenticated attacker to execute code remotely over a network. The CVSS 3.1 base score is 9.8 (critical), and the vector requires no privileges and no user interaction. Microsoft has released security updates; no in-the-wild exploitation or public proof-of-concept was found at the time of research.
Affected
- Windows 10 Version 1607 and Windows Server 2016 (build below 10.0.14393.9612)
- Windows 10 Version 1809 (build below 10.0.17763.9376)
- Windows 10 Version 21H2 (build below 10.0.19044.7807)
- Windows 10 Version 22H2 (build below 10.0.19045.7807)
- Windows 11 Version 23H2 (build below 10.0.22631.7652)
- Windows 11 Version 24H2 (build below 10.0.26100.9711)
- Windows 11 Version 25H2 and 26H2 (build below 10.0.26200.9711 and 10.0.26300.9711)
- Windows 11 Version 26H1 (build below 10.0.28000.3231)
- Windows Server 2012 and 2012 R2 (build below 6.2.9200.26434 and 6.3.9600.23470)
Fixed in
- Security update released on 13 October 2026 (see MSRC advisory for the KB article numbers per version)
- Fixed builds: see affected list above; verify the build for Windows 10 1607 on the MSRC page before deployment
Workaround
Unknown. No vendor-documented workaround was found; patching is the primary fix.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total
- Microsoft exploit code maturity: Unproven at release
- No public proof-of-concept found
- Not listed in CISA KEV at the time of research (re-check the catalog directly)
Our recommendation
- Inventory all Windows 10 1607, Windows Server 2016 and other systems below the fixed builds
- Deploy the October 2026 cumulative update and verify the KB number and build on the MSRC page
- If a system cannot be patched, isolate it and restrict network access to it
- Check whether Windows 10 1607 and Server 2016 are still supported and receiving updates
- Monitor CISA KEV and vendor advisories for changes in exploitation status
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Microsoft Windows Media Foundation
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC advisory CVE-2026-85814 msrc.microsoft.com
- Vulners NVD mirror CVE-2026-85814 vulners.com
- GitHub alert (KEV status snapshot) github.com
- OpenCVE CVE record details app.opencve.io
- ZDI October 2026 security update review www.zerodayinitiative.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:26.
Original description (NVD)
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.