CVE-2026-50655

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 38th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile38th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-22Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your exact Windows 10/11 or Windows Server version and OS build number (the “About” page / system info / or your IT inventory tool).
Compare your build to the Microsoft fixed builds for CVE-2026-50655:
- Windows 10: 10.0.14393.9339 OR 10.0.17763.9020 OR 10.0.19044.7548 OR 10.0.19045.7548
- Windows 11: 10.0.26100.8875 OR 10.0.26200.8875 OR 10.0.28000.2525
- Windows Server 2016: 10.0.14393.9339
- Windows Server 2019: 10.0.17763.9020
- Windows Server 2022: 10.0.20348.5386
- Windows Server 2025: 10.0.26100.33158
Install the Microsoft update(s) for CVE-2026-50655 for your system until you reach a fixed build.
If patching is delayed, immediately restrict staff from opening unexpected media files (especially files received via email or chat) and ensure endpoint protection and logging are enabled so you can detect suspicious behavior.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

CVE-2026-50655 is a Windows vulnerability in Windows Media that can let an attacker run code on your PC after you open a specially crafted media file; if you run the listed Windows versions, you should update soon because Microsoft has already published fixes.

CVE-2026-50655 is a heap-based buffer overflow in Windows Media that can lead to local remote code execution when an attacker can get a victim to open a maliciously crafted media input; Microsoft has released fixed builds for Windows 10/11 and Windows Server 2016/2019/2022/2025.

If you're affected

Full system takeover
Malware installation
Data theft risk
Operational disruption

What is it

Windows Media is part of Windows that helps your computer play different kinds of audio and video. This bug is a memory-handling error that can let a malicious file trick Windows into running attacker code. Think of it like a “broken lock” in how Windows reads certain media—if someone gets you to play a crafted file, the attacker may gain control of the machine.

Who is affected

This matters to you if you run Windows 10, Windows 11, or any of the listed Windows Server versions (2016/2019/2022/2025). The risk is tied to Windows Media handling a crafted media input, and the attacker also needs a way to get the file opened (there’s user involvement). Only take it seriously on systems that have the vulnerable Windows build and are exposed to users opening untrusted media (for example, files from email, messaging, or the web).

How urgent is it

This is a RED situation because it’s a remote code execution issue in a widely used Windows component and Microsoft has fixes available for multiple currently supported Windows versions. Even though it requires user interaction to open a crafted media file, attackers can often deliver such files through everyday channels like email and messaging, so unpatched systems are a high-value target.

What to do — in detail

Confirm exposure (per device)
- On each affected machine, record:
  - Windows edition (Windows 10/11 or which Windows Server year)
  - Exact OS build number (e.g., the “10.0.x.y” shown in System Information / About).
- Determine vulnerability by checking whether the build is below the fixed build listed by Microsoft for CVE-2026-50655 (the “fixed in” versions below).
Upgrade to the fixed builds (target versions)
- Windows 10:
  - fixed in 10.0.14393.9339
  - fixed in 10.0.17763.9020
  - fixed in 10.0.19044.7548
  - fixed in 10.0.19045.7548
- Windows 11:
  - fixed in 10.0.26100.8875
  - fixed in 10.0.26200.8875
  - fixed in 10.0.28000.2525
- Windows Server 2016:
  - fixed in 10.0.14393.9339
- Windows Server 2019:
  - fixed in 10.0.17763.9020
- Windows Server 2022:
  - fixed in 10.0.20348.5386
- Windows Server 2025:
  - fixed in 10.0.26100.33158
How to deploy
- Use your normal patching method (Windows Update for Business / WSUS / your endpoint management tool) and ensure the CVE-2026-50655 update is included.
- After installation, reboot if required, then re-check the OS build number to confirm it now matches or exceeds the fixed build.
Workaround if you cannot patch immediately
- Reduce the chance of exploitation by preventing users from opening unexpected media files:
  - Treat unexpected audio/video attachments and links as untrusted.
  - Block or quarantine unknown media at the email gateway if you have that capability.
- Strengthen detection:
  - Ensure endpoint detection/logging is on (so you can notice suspicious processes after a media file is opened).
What to monitor
- Look for new or unusual application behavior shortly after users open media content (unexpected process launches, unexpected persistence actions, or repeated crashes).

Note on exploitation status

Based on the provided findings, there is no public exploit code on record and it is not listed in CISA KEV; however, Microsoft has issued fixes, and this is still a serious code-execution risk.

Technical context

Severity and nature: This is a Windows Media vulnerability involving a heap-based buffer overflow (CWE-122) that can result in code execution. The provided product description indicates “unauthorized attacker” code execution, and the Windows Media Foundation context aligns with media parsing/handling.

Attack mechanism: The weakness is triggered by processing maliciously crafted media input. The exploitability details in the record indicate it is local (attack vector local) and requires user interaction (the victim typically must open/play a crafted file).

Exploitation status: The findings do not report KEV listing and state there is no public exploit code on record; exploitation is therefore not confirmed in the provided sources.

Patch status: Microsoft has fixed builds for multiple Windows 10/11 and Windows Server branches, with the fixed build numbers listed in the Patch section.

KEV/EPSS meaning here: KEV is not listed, and EPSS is only a prediction; per the provided rule, the urgent response here is driven primarily by the presence of Microsoft patches and the high-impact remote code execution class of the bug (traffic-light verdict is RED).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS38th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 38th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 8 days, from the signal feeds we watch.

2026-07-22Patch availablerecord updated
2026-07-16OpenVAS check added
2026-07-15Record updated
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 19 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable