CVE-2026-57087

What it actually does

This vulnerability is a heap-based buffer overflow in Microsoft Windows Media Foundation. A specially crafted media stream or file can cause Media Foundation to write outside the bounds of allocated heap memory during parsing or decoding. If exploitation succeeds, an unauthenticated remote attacker can achieve arbitrary code execution in the context of the process handling the media content. The CVSS vector indicates network reachability, low attack complexity, no privileges required, and required user interaction, meaning exploitation typically depends on a user opening, previewing, or otherwise causing Windows to process attacker-controlled media content.

Why it matters to the business

Successful exploitation could allow an attacker to compromise Windows workstations or servers that process malicious media content, leading to malware execution, credential theft, lateral movement, data theft, or disruption. Because the affected products include many supported Windows client and server versions, exposure may be broad across organizations that have not applied current Microsoft security updates. The issue is not currently listed in CISA KEV, has no reported ransomware association, and has a relatively low EPSS score, but the high CVSS impact means it should still be remediated promptly as part of normal patch cycles, especially on systems used for email, web browsing, file sharing, media processing, or remote desktop workflows.

How an attack unfolds

An attacker prepares malicious media content designed to trigger the heap overflow in Windows Media Foundation. The content may be hosted on a website, shared over SMB or WebDAV, sent as an attachment, embedded in a document or message, or delivered through another network-accessible location. A victim must interact with the content in a way that causes Windows Media Foundation to parse it, such as opening the file, previewing it, browsing to a page that loads the media, or using an application that invokes Media Foundation. If the malformed data corrupts heap memory in a controlled way, the attacker can redirect execution and run code under the privileges of the affected user or service process. After code execution, the attacker would typically stage malware, establish persistence, steal credentials or tokens, and attempt lateral movement. No public exploit maturity is currently reported, so defenders should prioritize patching and monitor for suspicious crashes or unexpected child processes spawned from media-handling applications.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-57087 for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. No exact fixed build numbers were provided in the input, so use Microsoft Update, Windows Server Update Services, Microsoft Update Catalog, or enterprise patch management tooling to install the latest cumulative security update applicable to each supported operating system. Prioritize systems that receive untrusted files or URLs, perform media processing, expose file shares, support browsing/email activity, or are used by privileged users. Where immediate patching is not possible, reduce exposure by restricting untrusted media file handling, blocking high-risk attachment types, disabling automatic preview where feasible, enforcing application control, limiting outbound execution from user-writable locations, and using endpoint protection to detect exploit behavior. Ensure unsupported Windows versions are upgraded to supported releases or isolated because they may not receive security fixes.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft cumulative security update released for this vulnerability or a later cumulative update. Validate through Windows Update history, WSUS or endpoint management compliance reports, Microsoft Update Catalog KB applicability, and operating system build numbers. Re-scan systems with authenticated vulnerability scanning after patch deployment. On representative endpoints, verify that Media Foundation-related binaries have been updated as part of the monthly cumulative update. Confirm that email, web, and file-sharing controls are still enforcing attachment filtering and preview restrictions where used as mitigations. For servers, verify that no workloads unnecessarily process untrusted media content. If testing is performed, use only benign vendor or scanner checks rather than live exploit media.

Typical attack path

1. Attacker crafts a malformed media file or stream that exercises the vulnerable Windows Media Foundation parsing or decoding path.
2. Attacker delivers the content through a network-accessible channel such as a website, email attachment, file share, collaboration platform, or WebDAV/SMB link.
3. User opens, previews, or otherwise causes the malicious content to be processed by an application that uses Windows Media Foundation.
4. The malformed media triggers heap memory corruption in the affected component.
5. Attacker-controlled code executes in the context of the media-handling process or current user session.
6. Attacker deploys a payload, collects credentials or sensitive data, establishes persistence, and may attempt lateral movement.

How to detect it

To determine whether exploitation may already have occurred, review endpoint, Windows Event Log, EDR, email, web proxy, and file-share telemetry for suspicious media handling activity. Focus on crashes or access violations in applications that use Windows Media Foundation, including media players, browsers, email clients, Explorer preview handlers, and Media Foundation protected media processes. Investigate Windows Error Reporting events, Application log crashes, and EDR crash telemetry showing exception code 0xc0000005 or heap corruption indicators near the time a user accessed an untrusted media file or URL. Look for abnormal child processes launched by media-handling processes, such as command shells, PowerShell, script hosts, rundll32, regsvr32, mshta, certutil, bitsadmin, or unsigned executables from user-writable directories. Correlate with web proxy, DNS, email gateway, and SMB/WebDAV logs showing downloads or opens of unusual media files shortly before suspicious process activity. Review file system artifacts in Downloads, email attachment caches, browser caches, Teams/Slack/collaboration caches, Temp directories, and network share access logs for recently introduced media files from external or untrusted sources. There are no CVE-specific public exploit indicators provided, so detection should be behavior-based: media parser crash followed by code execution, payload staging, persistence creation, credential access, or outbound command-and-control traffic.

• Faulting application name: mfpmp.exe
• Faulting application name: wmplayer.exe
• Faulting module name: mf.dll
• Faulting module name: mfplat.dll
• Exception code: 0xc0000005
• mfpmp.exe
• wmplayer.exe
• Windows Media Player
• Media Foundation
• mf.dll
• mfplat.dll
• mfpmp.exe -> cmd.exe
• mfpmp.exe -> powershell.exe
• mfpmp.exe -> pwsh.exe
• mfpmp.exe -> wscript.exe
• mfpmp.exe -> cscript.exe
• mfpmp.exe -> mshta.exe
• mfpmp.exe -> rundll32.exe
• mfpmp.exe -> regsvr32.exe
• wmplayer.exe -> cmd.exe
• wmplayer.exe -> powershell.exe
• wmplayer.exe -> wscript.exe
• wmplayer.exe -> mshta.exe
• wmplayer.exe -> rundll32.exe
• wmplayer.exe -> regsvr32.exe
• \AppData\Local\Temp\
• \AppData\Local\Microsoft\Windows\INetCache\
• \AppData\Local\Microsoft\Windows\Explorer\thumbcache

What your security team should do

• Patch all affected Windows client and server systems with the applicable Microsoft cumulative security update or later, prioritizing internet-facing, user-facing, and privileged-user systems.
• Use endpoint management or vulnerability scanning to identify Windows 10, Windows 11, and Windows Server assets that are missing the relevant security update.
• Increase monitoring for crashes in media-handling processes followed by child process creation, script execution, network callbacks, or credential access behavior.
• Harden delivery paths by filtering or sandboxing untrusted media attachments and links from email, web, file-sharing, and collaboration platforms.
• Disable or restrict automatic preview of untrusted media files where operationally feasible until patching is complete.
• Apply application control or attack surface reduction policies to block Office, browsers, media players, and preview handlers from spawning interpreters, shells, or unsigned executables.
• Review EDR telemetry for suspicious execution chains involving Media Foundation components, media players, browsers, email clients, Explorer preview handlers, or protected media processes.
• Because no public exploitation or KEV listing is reported, handle as high-impact patch-priority vulnerability rather than confirmed active exploitation, while continuing to monitor for new exploit availability.