AI analysis
CVE-2026-96952 is a heap-based buffer overflow (CWE-122) in Microsoft Windows Media Foundation. An unauthorized attacker can deliver malicious content over a network; if a user interacts with that content, the overflow can let the attacker execute code with the privileges of the affected process. The CVSS 3.1 score is 8.8 (high): network access, low complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability, with unchanged scope. The component is part of Windows and the flaw is covered by Microsoft's October 2026 Patch Tuesday updates, though exact affected version ranges were not stated in the supplied data. It is not in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.
What to do: Install Microsoft's October 2026 security updates that address CVE-2026-96952 on all supported Windows systems that include Media Foundation. Until those updates are applied, avoid opening media files or streams from untrusted sources, because exploitation requires a user to interact with attacker-supplied content. No public exploit is known and the issue is not listed in CISA's KEV catalog.
Affected
| Microsoft Windows Media Foundation | — |
Estimated exposure
massHundreds of millions to over 1 billion Windows installations (order-of-magnitude estimate) — Windows Media Foundation ships as a built-in component of modern Windows, which is deployed on the large majority of desktop PCs and many other endpoints worldwide, so the plausible install base is in the hundreds of millions to over a…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.