CVE-2026-58610

What it actually does

This vulnerability is a heap-based buffer overflow in Microsoft Windows Media Foundation. When Windows processes a specially crafted media file or media stream through the affected component, memory corruption can occur in a way that allows attacker-controlled code to run in the context of the user or process handling the content. The CVSS vector indicates local attack conditions with low attack complexity, no privileges required, and required user interaction, meaning exploitation generally depends on a user opening or previewing malicious media content rather than a purely remote unauthenticated network attack. Successful exploitation can provide full confidentiality, integrity, and availability impact on the affected system.

Why it matters to the business

An attacker who convinces a user to open or preview malicious media content could gain code execution on Windows endpoints or servers where Windows Media Foundation is present. This can lead to malware installation, data theft, credential access, lateral movement, or disruption of affected workstations and server workloads. The vulnerability affects many supported Windows 10, Windows 11, and Windows Server versions, so enterprise exposure can be broad. It is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has a low EPSS score, but the code-execution impact and wide Windows footprint make timely patching important, especially for systems where users handle media files, email attachments, browser downloads, collaboration content, or shared file repositories.

How an attack unfolds

An attacker prepares a malformed media file or stream designed to trigger a heap corruption condition in Windows Media Foundation. The attacker then delivers that content through a channel likely to reach a Windows user, such as email, messaging, a file share, removable media, a website download, or a collaboration platform. When the victim opens, previews, or otherwise causes the content to be parsed by an affected Windows component or application that relies on Media Foundation, the overflow corrupts process memory. If the exploit succeeds, attacker-controlled code executes with the privileges of the user or affected process. The attacker can then establish persistence, launch additional tools, steal data or credentials accessible to that user, and attempt privilege escalation or lateral movement. No public exploit maturity or known active exploitation is currently reported in the provided data, but defenders should still treat suspicious media-triggered crashes and unusual child processes from media-handling applications as high-value investigation leads.

How to fix it

Apply the Microsoft security update or cumulative update that addresses this vulnerability for all affected Windows versions, including Windows 10 1607, 1809, 21H2, 22H2; Windows 11 24H2, 25H2, 26H1; Windows Server 2016, 2019, 2022, and 2025. Because no exact fixed build or KB is provided in the input, use Microsoft Update, Windows Update for Business, WSUS, Microsoft Configuration Manager, or the Microsoft Update Catalog to deploy the July 2026 or later cumulative security update that supersedes the vulnerable component. Where patching must be delayed, reduce exposure by blocking or quarantining untrusted media attachments, disabling automatic preview of media files where feasible, restricting downloads from untrusted sources, enforcing least privilege for interactive users, and removing or disabling Windows Media Foundation on servers where it is not required. On Windows Server systems where the Media Foundation feature is unnecessary, consider removing the optional feature using supported administrative tooling after validating application dependencies.

How to confirm the fix worked

Confirm remediation by verifying that affected Windows systems have installed the Microsoft cumulative security update that includes the fix, or a later superseding update. Use centralized patch management reporting, vulnerability scanner authenticated checks, Windows Update history, and OS build inventory to confirm coverage across all affected client and server versions. Validate that no unsupported or out-of-date Windows builds remain in scope. For higher assurance, compare key Windows Media Foundation binaries against versions delivered by the fixed cumulative update and confirm file signatures are valid Microsoft signatures. If mitigation rather than patching is used, confirm that media preview, media handling, and optional Media Foundation components are disabled or restricted as intended, and test business applications for dependency impact.

Typical attack path

1. Attacker identifies target users or systems likely to open media files or preview rich content on affected Windows versions.
2. Attacker crafts or obtains a malicious media file or stream that triggers the Windows Media Foundation heap overflow.
3. Attacker delivers the content through email, chat, file sharing, a web download, removable media, or another user-accessible channel.
4. Victim opens, previews, indexes, or otherwise processes the malicious content with an affected Windows component or application.
5. Windows Media Foundation mishandles the crafted content, causing heap memory corruption.
6. Exploit payload executes in the context of the user or media-handling process.
7. Attacker runs follow-on commands, drops malware, steals accessible data, or attempts privilege escalation and lateral movement.

How to detect it

To determine whether exploitation may already have occurred, review endpoint telemetry, Windows Event Logs, EDR alerts, and crash reports for media-handling applications or Windows Media Foundation components crashing immediately before suspicious activity. Focus on sequences where a user opens or previews a media file and the same process, or a closely related process, spawns command shells, scripting engines, installers, archive tools, credential access tools, or unusual network connections. Relevant log sources include Windows Application event logs, Windows Error Reporting artifacts, Sysmon process creation and network events, PowerShell logs, Defender/EDR detections, email and web gateway logs for delivered media attachments, file share access logs, and browser download history. Look for access to recently delivered or downloaded media files followed by access violations in Media Foundation-related modules and then execution of powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, bitsadmin.exe, certutil.exe, or unknown binaries from user-writable directories. Since no public exploit indicators or known threat actor campaigns are provided, treat these as behavioral hunting leads rather than definitive proof of compromise.

• Faulting application name: mfpmp.exe
• Faulting application name: wmplayer.exe
• Faulting module name: mfplat.dll
• Faulting module name: mf.dll
• Faulting module name: mfreadwrite.dll
• Exception code: 0xc0000005
• Windows Error Reporting\ReportArchive\AppCrash_mfpmp.exe
• Windows Error Reporting\ReportQueue\AppCrash_mfpmp.exe
• wmplayer.exe -> powershell.exe
• wmplayer.exe -> cmd.exe
• mfpmp.exe -> powershell.exe
• mfpmp.exe -> cmd.exe
• mfpmp.exe -> wscript.exe
• mfpmp.exe -> cscript.exe
• mfpmp.exe -> mshta.exe
• mfpmp.exe -> rundll32.exe
• mfpmp.exe -> regsvr32.exe

What your security team should do

• Prioritize deployment of the applicable Microsoft cumulative security update across affected Windows endpoints and servers, with accelerated rollout for systems used to open external files, email attachments, browser downloads, or collaboration content.
• Inventory Windows 10, Windows 11, and Windows Server assets to identify systems with Windows Media Foundation present and confirm patch status through authenticated scanning or endpoint management telemetry.
• Temporarily restrict untrusted media file handling in email, web, chat, and file-sharing gateways until patch coverage is complete.
• Harden endpoints by enforcing least privilege, attack surface reduction rules, controlled application execution, and endpoint detection coverage for suspicious child processes from media-handling applications.
• Review crash telemetry and endpoint logs for media-related application crashes followed by process creation, script execution, network connections, or file drops.
• On servers, remove or disable Windows Media Foundation where it is not required, after dependency testing.
• Because the vulnerability is 28 days published and not currently KEV-listed with low EPSS, prioritize based on exposure and asset criticality, but do not defer indefinitely due to the high-impact code execution outcome.