CVE-2026-57090

What it actually does

This vulnerability is a heap-based buffer overflow in Microsoft Windows Media Foundation. A specially crafted media file or media stream can cause Media Foundation to write past the bounds of an allocated heap buffer during parsing or processing. If successfully exploited, the attacker can corrupt process memory and execute arbitrary code in the context of the application that invoked Media Foundation, such as a media player, browser component, document previewer, collaboration client, or other software that processes media. The CVSS vector indicates network-based delivery, low attack complexity, no privileges required, and required user interaction, with high confidentiality, integrity, and availability impact.

Why it matters to the business

Successful exploitation could allow an external attacker to compromise a Windows workstation or server after a user opens, previews, or otherwise processes malicious media content. The consequences can include malware installation, data theft, lateral movement, ransomware staging, and disruption of systems that handle audio or video files. The issue affects a broad range of supported Windows client and server versions, including Windows 10, Windows 11, and Windows Server releases from 2012 through 2025, so organizations should treat patching as broadly applicable even though it is not currently listed in CISA KEV and has no known public exploit maturity in the provided data.

How an attack unfolds

An attacker prepares a malformed media file or stream designed to trigger heap corruption in Windows Media Foundation. The attacker then delivers the content over a network path, such as a website, file share, messaging platform, email attachment, embedded media link, or other workflow where Windows parses media content. A target user must interact with the content, for example by opening it, previewing it, browsing to a page that loads it, or using an application that automatically generates media metadata or thumbnails. When Media Foundation processes the crafted content, the heap overflow can be triggered. With reliable exploitation, the attacker gains code execution inside the affected process and can then attempt to spawn commands, inject into other processes, download payloads, persist, or move laterally depending on the compromised user’s privileges and endpoint controls.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows versions: Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; and Windows Server 2012, 2016, 2019, 2022, and 2025. Where exact fixed build or KB numbers are not available from the supplied data, use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, or equivalent patch management tooling to identify and deploy the July 2026 or later cumulative update that remediates CVE-2026-57090. Prioritize endpoints and servers that routinely process media, preview attachments, expose file upload or media-processing workflows, or are used by high-risk users. If immediate patching is not possible, reduce exposure by blocking or quarantining untrusted media attachments, disabling automatic preview/thumbnail generation where feasible, restricting media downloads from untrusted sites, using application control to prevent suspicious child processes from media-handling applications, and ensuring EDR exploit protection is enabled for common media consumers.

How to confirm the fix worked

Confirm affected systems have installed the applicable Microsoft cumulative security update released on or after the vendor fix for this vulnerability. Validate through centralized patch inventory, Windows Update compliance reports, WSUS or Configuration Manager deployment status, vulnerability scanner authenticated checks, and endpoint build/KB verification. On representative systems, verify that Windows Media Foundation-related binaries have been updated to versions associated with the fixed Windows build. Confirm that unsupported or out-of-service Windows versions are not present or are isolated. For compensating controls, test that untrusted media attachments or downloads are blocked as intended, preview handlers are disabled where required, and EDR policies alert on exploit-like behavior from media-processing applications.

Typical attack path

1. Identify organizations and users likely to receive or process media content on affected Windows versions.
2. Create or obtain a specially crafted audio/video/media file or stream that triggers the Media Foundation heap overflow.
3. Deliver the content through a network-accessible vector such as a web page, email attachment, collaboration tool, file share, or hosted download.
4. Induce the user or an application workflow to open, preview, index, thumbnail, or otherwise parse the media content.
5. Trigger memory corruption in the Media Foundation parsing path.
6. Execute attacker-controlled code in the context of the media-handling application.
7. Use the initial execution to download a second-stage payload, establish command and control, steal data, or attempt privilege escalation and lateral movement.

How to detect it

To assess possible prior exploitation, correlate media-processing crashes with suspicious follow-on behavior. Review Windows Application logs, Windows Error Reporting events, EDR telemetry, Sysmon logs, proxy logs, email security logs, file download records, and collaboration/file-sharing audit logs. Look for crashes in applications that consume Windows Media Foundation, especially around the time a user opened or previewed an unfamiliar media file, followed by child processes such as command shells, PowerShell, script hosts, installers, archive tools, or unexpected network connections. Investigate Windows Error Reporting events showing access violations or heap corruption in Media Foundation DLLs such as mf.dll, mfplat.dll, mfcore.dll, mfreadwrite.dll, or related codec components. In EDR data, hunt for media applications spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, or unknown binaries. Also review recent downloads or attachments with media extensions from untrusted sources, including .mp4, .mov, .avi, .mkv, .wmv, .asf, .mp3, .wav, .m4a, and similar formats. Because no public exploit maturity or KEV listing is provided, detections should focus on exploit symptoms and post-exploitation behavior rather than a known fixed signature.

• Faulting module name: mf.dll
• Faulting module name: mfplat.dll
• Faulting module name: mfcore.dll
• Faulting module name: mfreadwrite.dll
• Exception code: 0xc0000005
• Exception code: 0xc0000374
• Windows Error Reporting
• Application Error
• wmplayer.exe
• Video.UI.exe
• Microsoft.Photos.exe
• dllhost.exe
• explorer.exe
• cmd.exe spawned by wmplayer.exe
• powershell.exe spawned by wmplayer.exe
• wscript.exe spawned by wmplayer.exe
• cscript.exe spawned by wmplayer.exe
• mshta.exe spawned by wmplayer.exe
• rundll32.exe spawned by wmplayer.exe
• regsvr32.exe spawned by wmplayer.exe
• certutil.exe spawned by wmplayer.exe
• bitsadmin.exe spawned by wmplayer.exe
• curl.exe spawned by wmplayer.exe
• cmd.exe spawned by Microsoft.Photos.exe
• powershell.exe spawned by Microsoft.Photos.exe
• rundll32.exe spawned by Microsoft.Photos.exe
• cmd.exe spawned by dllhost.exe
• powershell.exe spawned by dllhost.exe
• C:\Windows\System32\mf.dll
• C:\Windows\System32\mfplat.dll
• C:\Windows\System32\mfcore.dll
• C:\Windows\System32\mfreadwrite.dll
• C:\Windows\SysWOW64\mf.dll
• C:\Windows\SysWOW64\mfplat.dll
• C:\Windows\SysWOW64\mfcore.dll
• C:\Windows\SysWOW64\mfreadwrite.dll

What your security team should do

• Prioritize deployment of the applicable Microsoft Windows cumulative updates across all affected Windows client and server versions.
• Patch high-risk systems first, including user workstations, remote desktop/session hosts, VDI images, file servers, collaboration endpoints, media-processing servers, and systems used by privileged users.
• Use authenticated vulnerability scanning and patch compliance reporting to identify systems missing the remediating cumulative update.
• Temporarily restrict untrusted media file delivery through email, web gateways, collaboration platforms, and file-sharing workflows until patch coverage is high.
• Harden endpoint controls to alert on media-handling applications spawning shells, script interpreters, installers, or network download utilities.
• Review recent endpoint and application logs for Media Foundation crashes followed by suspicious process creation or outbound network activity.
• Ensure EDR exploit protection, memory corruption detections, attack surface reduction rules, and application control policies are enabled where operationally feasible.
• Because this issue has no known public exploit maturity and is not in KEV in the supplied data, balance urgency with exposure, but do not defer broadly because the flaw enables remote code execution with no attacker authentication.