CVE-2026-108400: Integer overflow RCE in Microsoft Windows Codecs Library · ZeroHour

CVE-2026-108400

mass

Integer overflow RCE in Microsoft Windows Codecs Library

CVSS 3.1

8.8 high

EPSS

—

Published

Oct 13, 2026 (3d ago)

Modified

Oct 13, 2026

AI analysis

CVE-2026-108400 is an integer overflow or wraparound (CWE-190) in the Microsoft Windows Codecs Library. A remote, unauthenticated attacker can trigger it over the network if a user interacts with malicious content, such as a crafted media or image file. Successful exploitation can run attacker code with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8; network, low complexity, no privileges, user interaction required, unchanged scope). Any Windows system that uses the affected Codecs Library build is in scope; specific version ranges were not listed in the supplied data and the issue is tied to the October 2026 security updates. It is not in the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.

What to do: Install the October 2026 Microsoft security updates that cover the Windows Codecs Library. Until systems are patched, avoid opening image or media files from untrusted sources or links, because exploitation requires a user to interact with attacker-controlled content. There is no CISA KEV listing and no public proof-of-concept in the supplied data.

Affected

Microsoft Windows Codecs Library

—

Estimated exposure

massOn the order of hundreds of millions to about 1 billion Windows installations (exact vulnerable subset unknown) — The Windows Codecs Library ships with Microsoft Windows, which has on the order of a billion active installations worldwide; the advisory does not publish a count of still-unpatched builds, so this is an order-of-magnitude estimate of the…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.

Weakness: CWE-190
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-108400

In the news1 stories

The October 2026 Security Update Review