Microsoft Windows DirectMusic: Heap buffer overflow allows local code execution
Summary
A heap-based buffer overflow in the Microsoft Windows DirectMusic component allows code execution. An attacker needs local access and a low-privilege account, and no user interaction is required. Successful exploitation would give full control over confidentiality, integrity and availability, most likely as privilege escalation after an initial foothold.
Affected
- Windows 10 Version 1607 (builds before 10.0.14393.9688)
- Windows 10 Version 1809 (builds before 10.0.17763.9487)
- Windows 10 Version 21H2 (builds before 10.0.19044.7846)
- Windows 10 Version 22H2 (builds before 10.0.19045.7846)
- Windows 11 Version 23H2 (builds before 10.0.22631.7711)
- Windows 11 Version 24H2 (builds before 10.0.26100.9974)
- Windows 11 Version 25H2 (builds before 10.0.26200.9974)
- Windows 11 Version 26H1 (builds before 10.0.28000.3501)
- Windows 11 Version 26H2 (builds before 10.0.26300.9974)
- Windows Server 2016, including Server Core (builds before 10.0.14393.9688)
- Windows Server 2019, including Server Core (builds before 10.0.17763.9487)
- Windows Server 2022 (builds before 10.0.20348.5870)
Fixed in
- Install the Microsoft security update for November 2026 or later for the affected Windows version.
- Fixed builds: 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974, 10.0.20348.5870.
- The associated KB number has not been verified.
Workaround
Unknown.
Exploitation
- No known exploitation at the time of publication.
- Not listed in the CISA Known Exploited Vulnerabilities catalog.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
Our recommendation
- Apply the November 2026 Microsoft security update to all affected Windows 10, 11 and Server systems, after verifying the KB number in the MSRC Security Update Guide.
- Prioritise multi-user systems, shared terminal servers and Windows 10 systems without Extended Security Updates.
- Inventory the Windows builds in use and identify systems that are below the fixed builds.
- Monitor for unusual local privilege escalation activity and re-check the exploitation status.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Windows Microsoft DirectMusic
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-95896 msrc.microsoft.com
- CVE.org record CVE-2026-95896 www.cve.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:03.
Original description (NVD)
Heap-based buffer overflow in Windows Microsoft DirectMusic allows an authorized attacker to execute code locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.