CVE-2026-122168: Microsoft Windows Media Foundation Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
Other sources
Microsoft Windows Media Foundation Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33822Fixed in 10.0.26100.33730Patch KB5131077 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26300.9974Fixed in 10.0.26300.9911Patch KB5132043 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9974Fixed in 10.0.26200.9911Patch KB5132043 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3501Patch KB5132059 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9974Fixed in 10.0.26100.9911Patch KB5132043 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.5870Patch KB5131090 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.7711Patch KB5131087 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19045.7846Patch KB5131096 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.7846Patch KB5131096 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.9487Patch KB5131085 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.14393.9688Patch KB5131291
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must already be authorized on the affected system and be able to execute code locally. The supplied vector indicates local access, with low attack complexity and no user interaction required.
What is the likely impact of successful exploitation?
Successful exploitation can elevate the attacker’s privileges on the local system. The provided severity vector indicates high impact to confidentiality, integrity, and availability.
Which systems should be assessed?
Assess Microsoft Windows 10, Windows 11, and Windows Server 2016, 2019, 2022, and 2025 systems that use Microsoft Windows Media Foundation. The provided information does not identify specific affected builds, patches, or configuration conditions.