Advisory · CVE-2026-100220
Heap overflow in Windows Media Video Decoder can run code via crafted media
The Windows media video decoder has a heap-based buffer overflow a remote attacker can use to execute code when a victim interacts with crafted media. Microsoft rates it CVSS 3.1 8.8.
- Vendor
- Microsoft
- Product
- Windows Media Video Decoder
- Identifier / CWE
- CVE-2026-100220
CWE-122 - Action timing
- Immediate
Explain it like I’m five
Pressing play on the wrong video file can overflow the decoder and hand the machine to whoever made the file.
- 01Attacker engages the component
A remote or authorized attacker sends crafted content or requests to Windows Media Video Decoder.
- 02Weakness triggers
The component mishandles the input and the flaw takes effect.
- 03Impact lands
The attacker gains the execution, elevation, or access the flaw allows.
What happened
Microsoft disclosed CVE-2026-100220 in its October 2026 update guide: a heap-based buffer overflow (CWE-122) in the Windows Media Video Decoder lets a remote attacker execute code when crafted media is played or processed.
Microsoft lists the affected releases and their patched build thresholds in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.
What to do
- Inventory every Windows Media Video Decoder deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Windows Media Video Decoder while remediation is underway, especially for internet-facing instances.
- Review application and server logs for media player crashes on specific video files and thumbnail-generation failures on servers.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Media decoding happens in previews and pipelines users never see. Patch broadly and check crash reports.