CVE-2026-56189

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 31st percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile31st0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-22Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which exact Windows version/build each affected device is running (including whether it’s Windows 10/11 or a Windows Server release).
Update every affected device to the fixed version for your specific Windows branch: 10.0.14393.9339, 10.0.17763.9020, 10.0.19044.7548, 10.0.19045.7548, 10.0.26100.8875, 10.0.26200.8875, 10.0.28000.2525, 6.2.9200.26226, 6.3.9600.23291, 10.0.20348.5386.
If you can’t patch right away, temporarily limit exposure of users to untrusted media/content that would trigger Windows Media Foundation (for example, reduce opening unknown files or media from email, chat, or the web on the affected devices) until updates are applied.
Confirm after updating that the same CVE remains absent by re-checking the OS build and verifying the Windows Update installation succeeded.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

This is a Windows flaw in Windows Media Foundation that can let an attacker run malicious code on your device when they can get the vulnerable component to be used—so you should update, especially on machines used for lots of user content or media.

CVE-2026-56189 is a heap-based buffer overflow (CWE-122) in Microsoft Windows Media Foundation that can lead to local remote code execution without authentication, but it requires user interaction to reach the vulnerable code path.

If you're affected

Full system takeover
Malware installation
Service disruption
Data theft risk

What is it

Windows Media Foundation is a built-in part of Windows that helps handle audio and video. This vulnerability is like a “crash-and-takeover” bug: if an attacker can cause the vulnerable media processing to run (with a user involved), it may allow the attacker’s code to run on your computer. In practical terms, that can turn a simple user activity involving media into a full compromise of the device.

Who is affected

This matters if you run Microsoft Windows Media Foundation on the affected Windows versions: Windows 10, Windows 11, and the listed Windows Server releases. The flaw does not require authentication, but it does require user interaction, meaning an attacker still needs a way to get the vulnerable media processing to be triggered on a device.

It’s only a meaningful risk when an attacker can reach a code path in Windows Media Foundation on your machine with user interaction; whether that’s reachable from your normal use is not yet clearly known from the provided information.

How urgent is it

Treat this as urgent because it can result in arbitrary code execution (a buffer overflow leading to takeover) on widely used Windows platforms. Even though the flaw requires user interaction and there’s no confirmed KEV listing in the provided findings, the impact (code execution) is severe enough that you should prioritize patching immediately for any affected systems you operate.

What to do — in detail

Confirm exposure (what to check)

For each device running Windows 10/11 or the impacted Windows Server versions, identify the exact OS version/build.
- A simple way is to review the Windows “About” page (or your standard endpoint inventory report).
Compare each device’s build to the fixed versions below (a device is still at risk if it is on an older build in the same branch).

Patch to the fixed versions

Apply the Windows update(s) for CVE-2026-56189 and make sure each device reaches the fixed version for its branch:

Windows 10: fixed in 10.0.14393.9339
Windows 10: fixed in 10.0.17763.9020
Windows 10: fixed in 10.0.19044.7548
Windows 10: fixed in 10.0.19045.7548
Windows 11: fixed in 10.0.26100.8875
Windows 11: fixed in 10.0.26200.8875
Windows 11: fixed in 10.0.28000.2525
Windows Server 2012: fixed in 6.2.9200.26226
Windows Server 2012 R2: fixed in 6.3.9600.23291
Windows Server 2016: fixed in 10.0.14393.9339
Windows Server 2019: fixed in 10.0.17763.9020
Windows Server 2022: fixed in 10.0.20348.5386

(Reference: Microsoft’s update guidance for CVE-2026-56189: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56189)

If patching must be delayed (temporary risk reduction)

Reduce the chance users trigger the vulnerable media processing:
- Avoid opening unknown/untrusted media files (audio/video) from email, chat, web downloads, or external storage.
- If your organization uses endpoint policies, consider tightening controls around launching or playing untrusted content until updates are applied.

After patching (verification)

Re-check each device’s build number to confirm it matches one of the fixed versions above for its branch.
Validate Windows Update success via your device management tooling (e.g., confirm the security update is installed).

What to monitor

Look for signs of suspicious activity on endpoints (new unusual processes or persistence), especially around the time users interacted with media from untrusted sources.
Monitor your standard endpoint detection/response alerts as usual; focus review on devices that could have been exposed through user-triggered media handling.

KEV / exploitation notes

This CVE is not listed in the provided CISA KEV findings.
No clear dated press claim or specific incidents involving exploitation were included in the provided materials, and no public exploit code was found in the provided findings.

Technical context

CVE-2026-56189 is a Microsoft Windows Media Foundation vulnerability with a CWE-122 classification (heap-based buffer overflow). The provided findings indicate remote code execution via buffer overflow with no authentication required, but user interaction is required to trigger the vulnerable path. The attack vector is described as local, and reachability in default configurations is unknown.

Operationally, treat it as high risk because the consequence is arbitrary code execution on affected Windows systems: Windows 10, Windows 11, and multiple Windows Server releases. Exploitation status in the provided findings: KEV not listed, no clear dated real-world exploitation report, and no public exploit code on record.

Patch availability is confirmed via Microsoft’s update guidance, with fixed build numbers provided for each affected OS branch listed in the findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS31st

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 31st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 8 days, from the signal feeds we watch.

2026-07-22Patch availablerecord updated
2026-07-16OpenVAS check added
2026-07-15Record updated
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 22 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable