Windows Media Player: Remote code execution via heap-based buffer overflow

Summary

A heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network. The attack requires a user to interact, for example by opening a crafted media file or stream, according to the CVSS vector (UI:R). The CVSS base score is 8.8 (High). The vendor page could not be checked during this review, so the affected builds and CVSS vector should be confirmed against the Microsoft Security Update Guide.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Fixed builds according to the CVE record ranges (verify on the MSRC page): 10.0.14393.9688 (1607, Server 2016), 10.0.17763.9487 (1809, Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.28000.3501 (26H1), 10.0.26300.9974 (26H2), 10.0.20348.5870 (Server 2022)
• Microsoft patch identifier: Unknown.

Workaround

• Unknown. No vendor workaround found.
• Until patched, block or quarantine untrusted media attachments and downloads at the mail and web gateway, and avoid opening unknown media files.

Exploitation

Unknown. No public exploitation information was found for this CVE.

Our recommendation

• Confirm the affected products and fixed builds on the Microsoft Security Update Guide.
• Install the Microsoft security update on all affected Windows clients and servers through Windows Update or WSUS, prioritising user workstations, VDI images and jump hosts.
• Until patched, restrict untrusted media files and streams from email and the web.
• Monitor for unusual Windows Media Player activity and check NVD for updates to the record.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88229 msrc.microsoft.com
• Microsoft Security Update Guide: CVE-2026-96096 (similar description, for comparison) msrc.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:56.