CVE-2026-100220

CVE-2026-100220 is a heap-based buffer overflow (CWE-122) in Microsoft’s Windows Media Video Decoder. A remote, unauthenticated attacker can trigger it by getting a user to process malicious media over the network; user interaction is required and attack complexity is low (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R/S:U). Successful exploitation can run code with high impact on confidentiality, integrity, and availability on the affected system. Windows installations that include this decoder are affected; exact build ranges are not stated in the source data and the flaw was called out in October 2026 Patch Tuesday coverage. It is not on the CISA Known Exploited Vulnerabilities list and no public proof-of-concept is known.

What to do: Install the October 2026 Microsoft security updates that fix the Windows Media Video Decoder as soon as they are available for your Windows builds. Until patched, avoid opening untrusted WMV or other media that uses this decoder, including files and links from email or the web, because exploitation requires a user to process attacker-controlled content.