CVE-2026-72960 – Windows Media Player Remote Code Execution Vulnerability

CVE-2026-72960 is a Critical remote code execution vulnerability caused by a heap-based buffer overflow in Windows Media Player. An unauthorized attacker can exploit the issue over a network by convincing a user to open a specially crafted file. Successful exploitation can allow attacker-controlled code to execute on the affected system. No privileges are required, but user interaction is required.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no attacker privileges. Successful exploitation can have a high impact on confidentiality, integrity, and availability. The attack still requires user interaction because the targeted user must open a specially crafted file.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is rated Unproven, and the exploitation assessment is Exploitation Unlikely. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-72960 is a heap-based buffer overflow, identified as CWE-122, affecting Windows Media Player. An attacker can prepare a specially crafted file and cause remote code execution when a user opens it. The attack vector is network-based, attack complexity is low, and no privileges are required, although user interaction is necessary. Successful exploitation can result in high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2016, 2019, 2022, and 2025, including listed Server Core installations. An attacker must get a user to open a specially crafted file to trigger remote code execution.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution and create serious confidentiality, integrity, and availability risks. For organizations, a malicious file reaching a user could result in compromise of an affected Windows system and disruption to business operations.

WORKAROUND: No workaround or mitigation is identified. An official fix is listed as the remediation, and affected systems require a restart.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8. Its network attack vector, low attack complexity, lack of required attacker privileges, and potential for high confidentiality, integrity, and availability impact make timely deployment important. Exploitation still requires a user to open a specially crafted file.