Microsoft DirectMusic: Remote code execution through double free

Summary

A double free vulnerability (CWE-415) in the Microsoft DirectMusic component of Windows allows an unauthorized attacker to execute code over the network. The CVE record lists a CVSS 3.1 base score of 9.8, but NVD had not yet analysed the CVE when this entry was created, so the score and CWE are unverified. Exploitation requires no privileges and no user interaction according to the supplied vector, so affected Windows systems reachable from the network are at high risk.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): 10.0.14393.0 to below 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): 10.0.17763.0 to below 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to below 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to below 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to below 10.0.26300.9974
• Windows Server 2022: 10.0.20348.0 to below 10.0.20348.5870

Fixed in

• The CVE record ranges imply fixed builds at or above the upper limits listed under affected (per the official CVE record).
• KB numbers: Unknown.
• Confirm the fixed builds in the MSRC entry before rollout.

Workaround

Unknown.

• No vendor workaround is documented in the supplied sources.

Exploitation

• CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
• No reports of exploitation in the wild, public proof of concept or CISA KEV entry were found at the time of writing.
• A different DirectMusic double free (CVE-2022-44668) was publicly described earlier, which shows this bug class has been exploitable before.

Our recommendation

• Open the MSRC entry and record the affected builds, KB numbers and the attack vector stated by Microsoft.
• Patch affected Windows clients and servers as a priority once the update is available, starting with internet-facing servers.
• Inventory Windows systems and check which can receive DirectMusic-triggering content from outside the network.
• Monitor the NVD and CISA KEV entries for changes to the score, CWE or exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-95901 msrc.microsoft.com
• StarLabs advisory on related DirectMusic double free (CVE-2022-44668) starlabs.sg

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:33.