CVE-2026-114167: HEVC Video Extensions Remote Code Execution Vulnerability
Published Nov 10, 2026
·Updated
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.
Other sources
HEVC Video Extensions Remote Code Execution Vulnerability
— Microsoft
Affected Software
4 affected componentsFixes available
Microsoft HEVC Video Extensions for Licensed Applications<2.4.150.0
2.4.150.0
Microsoft HEVC Video Extensions<2.4.151.0
2.4.151.0
Microsoft HEVC Video Extensions from Device Manufacturer<2.5.48.0
2.5.48.0
Microsoft HEVC Video Extensions from Device Manufacturer<2.4.149.0
2.4.149.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.150.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.151.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.5.48.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.149.0
Event History
Nov 10, 2026
CVE Published
via Microsoft·04:00 PM
Data Sourced
via Microsoft·04:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·06:15 PM
Data Sourced
via MITRE·06:15 PM
DescriptionSeverity
Data Sourced
via NVD·07:19 PM
DescriptionSeverityWeakness