CVE-2026-70203

Windows Media Player Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 55th percentile. A vendor fix is available.

CVSS 3.18.8High EPSS percentile55th0.8% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-08Updated 2026-09-24Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your Windows systems are using Windows Media Player (or have Media Player components/features installed) and confirm their Windows version/build.
Compare each affected machine’s Windows version against the fixed versions listed by Microsoft for CVE-2026-70203.
Install the latest available Windows updates that include the fix for CVE-2026-70203, prioritizing Windows Media Player–capable machines first.
Reboot after updates and verify the machine reports the updated build numbers (the fixed versions below) in Windows Update/System Information.
If you can’t patch immediately, restrict network access to the affected endpoints (limit inbound from untrusted networks) until updates are applied.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

This is a Windows Media Player flaw that can let an attacker run code over the network on unpatched Windows machines; most small businesses should act quickly to install the Microsoft fixes for Windows 10/11 and Windows Server that were affected.

CVE-2026-70203 is a heap-based buffer overflow in Windows Media Player that can be triggered to achieve remote code execution over a network connection without valid credentials.

If you're affected

Full device takeover
Ransomware risk
Server/service disruption
Data theft risk

What is it

Think of Windows Media Player like a program that opens and processes media coming from the network. This vulnerability is a “memory overflow” bug that can let an attacker take control of the machine by sending a specially crafted network request—so an unpatched device could be compromised even without usernames/passwords.

Who is affected

This matters if your business runs Microsoft Windows versions that include Windows Media Player—especially Windows 10 and Windows 11 desktops, and Windows Server 2012/2012 R2/2016/2019/2022/2025 systems.

Because the issue is reachable over a network and does not require valid credentials, your exposure is mainly about whether the vulnerable software is present and reachable from other networks (for example, through inbound access).

How urgent is it

This should be treated as urgent (RED) because the vulnerability allows remote attackers to run code over the network without credentials, which can lead directly to total compromise.

No public exploit code is listed in the findings and it’s not in CISA’s KEV list, but the risk is still high for unpatched systems due to the remote code execution impact.

What to do — in detail

Identify affected machines and their Windows build.
- On each device, open System Information (or Settings → System → About) and record the Windows version and OS build.
- Confirm whether Windows Media Player components are present/installed (even if rarely used, the component may still be present depending on your setup).
Determine whether each machine is on a vulnerable build.
- Patch-comparison targets (fixed versions) from Microsoft:
  - Windows 10: fixed in 10.0.14393.9512; 10.0.17763.9245; 10.0.19044.7725; 10.0.19045.7725
  - Windows 11: fixed in 10.0.22631.7582; 10.0.26100.9445; 10.0.26200.9445; 10.0.28000.2954
  - Windows Server 2012: fixed in 6.2.9200.26349
  - Windows Server 2012 R2: fixed in 6.3.9600.23397
  - Windows Server 2016: fixed in 10.0.14393.9512
  - Windows Server 2019: fixed in 10.0.17763.9245
Apply the fix.
- Install the Microsoft security updates that include CVE-2026-70203 using Windows Update, WSUS, or your standard patch management process.
- Use the Microsoft Update Guide page for CVE-2026-70203 to ensure you’re installing the correct update for your OS branch.
Reboot and validate.
- After patching, reboot and confirm the machine now shows a build number that is at or above the fixed version listed for its Windows release.
Temporary workaround if patching is delayed.
- Reduce exposure by limiting inbound network access to the affected devices from untrusted networks (for example, tighten firewall rules and restrict direct inbound access).
- Since this is a remote attack path, network segmentation and inbound restrictions can reduce the chance of a device being reached.
Monitor.
- Watch your security logs for unusual network traffic patterns targeting Windows Media Player services/components.
- Verify future patch cycles continue to apply successfully to any remaining vulnerable endpoints.

KEV notice: not listed in CISA KEV in the findings provided.

Technical context

Severity is high, with a CVSS score of 8.8 (High) indicating network reachability with no required privileges. The weakness is CWE-122: heap-based buffer overflow.

Mechanism: Windows Media Player contains a memory handling flaw that can be triggered remotely to corrupt heap memory, which can then be used to execute attacker-controlled code.

Exploitation/exploit maturity: the findings report no public exploit code on record and no KEV entry in CISA.

Likelihood (prediction): EPSS is reported as a low predicted likelihood (trend flat), but public likelihood alone does not reduce urgency given the remote code execution impact.

KEV meaning: the absence from KEV means there’s no authoritative CISA-confirmed exploitation listed in the provided findings; it does not mean the bug is safe.

Patch availability: fixed builds are provided by Microsoft per OS branch (see fixed versions list in what_to_do).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS55th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.8% chance of exploitation activity in the next 30 days, which ranks it in the 55th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 16 days, from the signal feeds we watch.

2026-09-24Patch availablerecord updated
2026-09-16Patch availablerecord updated
2026-09-10OpenVAS check added
2026-09-09Record updatedrecord updated
2026-09-08Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable