CVE-2026-108400: HEVC Video Extensions Remote Code Execution Vulnerability
HEVC Video Extensions Remote Code Execution Vulnerability
Other sources
Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.86.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.5.25.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.87.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.85.0
Event History
Frequently Asked Questions
What must an attacker do to exploit this vulnerability?
The attacker must get a user to interact with attacker-controlled content; the vector is network-based and the attack complexity is low. No attacker privileges are required.
What is the potential impact of a successful exploit?
A successful exploit can allow code execution with high impact to confidentiality, integrity, and availability.
Which software should be reviewed for exposure?
Review systems with Microsoft HEVC Video Extensions from Device Manufacturer, Microsoft HEVC Video Extensions, or Microsoft HEVC Video Extensions for Licensed Applications installed.