CVE-2026-58542 – Windows Media Remote Code Execution Vulnerability

A heap-based buffer overflow vulnerability in Windows Media allows an unauthorized attacker to execute code locally. Exploitation requires user interaction, such as opening or processing specially crafted media content. Successful exploitation could allow arbitrary code execution, potentially leading to system compromise and unauthorized access to sensitive information.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability affects the Windows Media component responsible for processing media content. An attacker could distribute a specially crafted media file through email, websites, messaging platforms, or file-sharing services and persuade a user to open it. If the malicious file is processed by the vulnerable component, arbitrary code could be executed on the affected system.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as unlikely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Windows Media. Improper handling of specially crafted media content can corrupt memory, allowing an attacker to execute arbitrary code. The CVSS v3.1 metrics identify a local attack vector, low attack complexity, no privileges required, and user interaction required. A successful exploit could allow the attacker to execute code with the privileges of the user who opened the malicious media file.

EXPLOITABILITY:
Affected products include Windows 11 versions 24H2, 25H2, and 26H1, and Windows Server 2025, including the affected Server Core installation. Exploitation requires a user to open or otherwise process specially crafted media content.

BUSINESS IMPACT:
Media files are frequently exchanged through email, collaboration tools, and websites, making them an effective vehicle for social engineering attacks. Successful exploitation could allow attackers to install malware, steal sensitive information, disrupt business operations, or establish persistent access to affected systems.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be prioritized because it is rated Critical. Although exploitation requires user interaction, malicious media files are a common attack vector, and successful exploitation could result in arbitrary code execution and compromise of affected systems.