---
id: "CVE-2026-114167"
page: "https://infrastack.ai/live/CVE-2026-114167"
kind: "vulnerability"
aliases: ["CVE-2026-114167"]
title: "HEVC Video Extensions (Windows Store codec): heap overflow can run code after a user opens a crafted file"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "HEVC Video Extensions", "fixed": ["2.4.151.0"], "affected": ">= 1.0.0, < 2.4.151.0", "ecosystem": "vendor"}, {"name": "HEVC Video Extensions for Licensed Applications", "fixed": ["2.4.150.0"], "affected": ">= 2.0.0.0, < 2.4.150.0", "ecosystem": "vendor"}, {"name": "HEVC Video Extensions from Device Manufacturer", "fixed": ["2.4.149.0"], "affected": ">= 2.0.0.0, < 2.4.149.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["hevc", "infrastructure", "microsoft-store", "user-interaction", "windows"]
not_affected_if: ["hevc-extension-not-installed", "store-auto-updated"]
published_at: "2026-11-10T19:19:10+00:00"
first_seen_at: "2026-11-10T19:24:44+00:00"
updated_at: "2026-11-10T23:41:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114167", "first_seen_at": "2026-11-10T19:24:44+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114167", "first_seen_at": "2026-11-10T23:41:57+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-114167"]}]
exploit_sources: []
---

# HEVC Video Extensions (Windows Store codec): heap overflow can run code after a user opens a crafted file

Link for people: https://infrastack.ai/live/CVE-2026-114167 (this .md is for agents)

Microsoft lists a heap-based buffer overflow (CWE-122) in the Windows Codecs Library, shipped as the HEVC Video Extensions packages. A local attacker needs a user to interact (CVSS UI:R), for example opening a crafted media file; code then runs as that user. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:HEVC Video Extensions affected >= 1.0.0, < 2.4.151.0 fixed 2.4.151.0
- vendor:HEVC Video Extensions for Licensed Applications affected >= 2.0.0.0, < 2.4.150.0 fixed 2.4.150.0
- vendor:HEVC Video Extensions from Device Manufacturer affected >= 2.0.0.0, < 2.4.149.0 fixed 2.4.149.0

## How to check

Open PowerShell: Get-AppxPackage *HEVCVideoExtension* | Select Name,Version. Exposed if version is below 2.4.151.0 (HEVC Video Extensions), 2.4.150.0 (for Licensed Applications) or 2.4.149.0 (from Device Manufacturer). Not installed means not exposed. Microsoft's own MSRC page was not readable (JavaScript only); ranges come from the Microsoft CNA data on NVD.

## Fix

Update the HEVC Video Extensions package via Microsoft Store to 2.4.151.0 or later (Licensed Applications: 2.4.150.0; Device Manufacturer: 2.4.149.0).

## Timeline

- 2026-11-10T19:24:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114167
- 2026-11-10T23:41:57+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-114167 — Tier B: affected products and fixed versions from Microsoft CNA data on NVD; MSRC page unreadable so nothing marked verified. Triage said Windows builds, actually Store codec packages. No exploitation found; UI:R.

## Documents

- [advisory] NVD CVE-2026-114167 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/CVE-2026-114167

## From the sources

Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_