CVE-2026-58599 – HEVC Video Extensions Remote Code Execution Vulnerability

CVE-2026-58599 is a critical remote code execution vulnerability caused by a heap-based buffer overflow in the Microsoft Windows Codecs Library. An unauthorized attacker can execute code locally by exploiting the flaw. Exploitation requires user interaction, but no privileges are required. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: The vulnerability creates a risk of arbitrary code execution through unsafe memory handling. Its low attack complexity and lack of privilege requirements increase the potential impact when the required user interaction occurs. Successful exploitation could compromise data confidentiality and integrity and disrupt system availability.

EXPLOITS: Microsoft assesses exploitation as less likely. The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven; the source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-58599 is a CWE-122 heap-based buffer overflow affecting the Microsoft Windows Codecs Library and HEVC Video Extensions. Improper handling of memory can allow an unauthorized attacker to trigger memory corruption and execute code locally. Attack complexity is low, no privileges are required, and user interaction is required. The security impact is rated High for confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include HEVC Video Extensions, HEVC Video Extensions for Licensed Applications, and Device Manufacturer editions on listed Windows 10 1809, 21H2, and 22H2 systems; Windows 11 23H2, 24H2, 25H2, and 26H1 systems; and Windows Server 2019, 2022, and 2025, including listed Server Core installations. Exploitation requires local attack conditions and user interaction but does not require privileges.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code execution and lead to loss of sensitive information, unauthorized modification of data, or disruption of affected systems. For organizations with vulnerable HEVC components deployed across endpoints or servers, a successful attack could turn media-processing functionality into a path for system compromise.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, and the HEVC package version can be checked with PowerShell using `Get-AppxPackage -Name Microsoft.HEVCVideoExtension*`.

URGENCY: This vulnerability is rated Critical and can result in code execution with high confidentiality, integrity, and availability impact. Although exploitation is assessed as less likely and no exploitation is reported, affected HEVC components should be updated promptly because there is no documented workaround or mitigation.