Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-96157 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | Microsoft |
| Product | Windows Media Foundation |
| Vulnerability Type | heap-based buffer overflow, remote code execution (CWE-122) |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
Windows Media Foundation is the system framework for audio and video processing used by media players, browsers and communication apps, among others. A flaw in a media parser can be triggered by a crafted file or stream.
Required Actions
- Install the November 2026 Windows security updates via Microsoft Update / WSUS / Intune on workstations and servers — prioritize internet-facing systems.
- Check MSRC (linked in Sources) for KB numbers and the list of affected Windows versions.
- Verify that the update actually reached every device, including those outside the domain.
Who Is Affected?
The vulnerability affects Microsoft Windows systems with Windows Media Foundation — in practice all workstations and many servers. MSRC lists the exact affected Windows versions and KB numbers.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-96157 vulnerability?
CVE-2026-96157 is a heap-based buffer overflow (CWE-122) in Microsoft Windows Media Foundation that enables remote code execution. CVSS score: 9.8. Microsoft released a fix in the November 2026 security updates.
Does exploiting CVE-2026-96157 require authentication?
According to the vendor's CVSS assessment, the attack is carried out over the network and requires no authentication or user interaction.
How to protect against CVE-2026-96157?
Install the November 2026 Windows security updates (Patch Tuesday) on all workstations and servers.
Who is affected by CVE-2026-96157?
Organizations running Windows systems that include the Windows Media Foundation component — in practice almost every company.
