{"id":"CVE-2026-122168","kind":"vulnerability","aliases":["CVE-2026-122168"],"related":[],"title":"Windows Media Foundation: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in Microsoft Windows Media Foundation lets an authorized local user corrupt memory. The sources say this lets that user elevate their privileges on the machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Windows Media Foundation","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local-privilege-escalation","media-foundation","windows"],"not_affected_if":["patched-build","unknown"],"how_to_check":"Run winver or [System.Environment]::OSVersion / (Get-ComputerInfo).OsBuildRevision and compare the full build number with the fixed builds in the fix field; lower means exposed.","fix":"Install the November 2026 Windows cumulative update so the build is at or above: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2/22H2 10.0.19044.7846/10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2/25H2 10.0.26100.9974/10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. KB numbers not confirmed.","status":"open","published_at":"2026-11-10T19:20:33+00:00","first_seen_at":"2026-11-10T19:25:10+00:00","triaged_at":"2026-11-10T19:38:57+00:00","updated_at":"2026-11-10T21:42:07+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Media Foundation: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in Microsoft Windows Media Foundation lets an authorized local user corrupt memory. The sources say this lets that user elevate their privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","media-foundation"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher system privileges on the machine","analyst_note":"Check Microsoft's advisory for CVE-2026-122168 for affected Windows builds, fixed update and detection steps.","how_to_check":"unknown","plain_action":"","product_name":"Microsoft Windows Media Foundation","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Windows machines with Media Foundation present and users with a local account can be affected. The sources do not say which Windows versions or configurations are affected, so unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":4503,"output_tokens":432,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Microsoft's advisory for CVE-2026-122168 for affected Windows builds, fixed update and detection steps.","search":"'-122168':15A,18A '-2026':14A,17A '10':24A,29A '11':34A '1607':25A '1809':30A '2016':27A '2019':32A '2022':41A '2025':38A '24h2':35A 'allow':92C 'attack':95C 'author':64B,94C 'base':54B,84C 'buffer':55B,85C 'corrupt':67B 'cve':13A,16A 'elev':76B,97C 'escal':46B 'foundat':3A,49B,61B,91C 'foundation':22A 'gain':10A 'heap':4A,53B,83C 'heap-bas':52B,82C 'higher':11A 'infrastructur':42B 'let':6A,62B,73B 'local':8A,44B,65B,99C 'local-privilege-escal':43B 'machin':81B 'media':2A,21A,48B,60B,90C 'media-found':47B 'memori':68B 'microsoft':19A,58B,88C 'overflow':5A,56B,86C 'privileg':12A,45B,78B,98C 'say':71B 'server':26A,31A,37A,40A 'sourc':70B 'user':9A,66B,75B 'window':1A,50B,59B,89C 'windows':20A,23A,28A,33A,36A,39A","nicknames":[],"mitigations":[],"who_affected":"Windows 10, Windows 11 and Windows Server 2016 to 2025 machines whose build is below the fixed build are listed as affected. An attacker needs a local, low-privilege account and can then gain higher privileges through a heap overflow in Media Foundation. Shared machines, terminal servers and workstations where untrusted users can log in matter most; single-user machines with no untrusted code are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1124h2","microsoftwindowsmediafoundation","server2022","server2025","windows101607server2016","windows101809server2019","windows1124h2","windowsmediafoundation","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","24h2","foundation","media","microsoft","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","mediafoundation","vendor","windows"],"campaign_type":null,"search_a":"'-122168':15A,18A '-2026':14A,17A '10':24A,29A '11':34A '1607':25A '1809':30A '2016':27A '2019':32A '2022':41A '2025':38A '24h2':35A 'cve':13A,16A 'foundat':3A 'foundation':22A 'gain':10A 'heap':4A 'higher':11A 'let':6A 'local':8A 'media':2A,21A 'microsoft':19A 'overflow':5A 'privileg':12A 'server':26A,31A,37A,40A 'user':9A 'window':1A 'windows':20A,23A,28A,33A,36A,39A","search_b":"'author':64B 'base':54B 'buffer':55B 'corrupt':67B 'elev':76B 'escal':46B 'foundat':49B,61B 'heap':53B 'heap-bas':52B 'infrastructur':42B 'let':62B,73B 'local':44B,65B 'local-privilege-escal':43B 'machin':81B 'media':48B,60B 'media-found':47B 'memori':68B 'microsoft':58B 'overflow':56B 'privileg':45B,78B 'say':71B 'sourc':70B 'user':66B,75B 'window':50B,59B","search_c":"'allow':92C 'attack':95C 'author':94C 'base':84C 'buffer':85C 'elev':97C 'foundat':91C 'heap':83C 'heap-bas':82C 'local':99C 'media':90C 'microsoft':88C 'overflow':86C 'privileg':98C 'window':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122168","severity":null,"published_at":"2026-11-10T19:20:33+00:00","modified_at":"2026-11-10T19:20:34+00:00","first_seen_at":"2026-11-10T19:25:10+00:00","fetched_at":"2026-11-10T19:25:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122168:2838","url":"https://app.opencve.io/cve/CVE-2026-122168","severity":null,"published_at":"2026-11-10T21:42:07+00:00","modified_at":"2026-11-10T21:42:07+00:00","first_seen_at":"2026-11-10T21:42:07+00:00","fetched_at":"2026-11-10T21:42:07+00:00","note":"MSRC page is JS-only and unreadable here; build ranges come from the Microsoft CNA record as mirrored by OpenCVE (secondary), so nothing marked verified. No exploitation or PoC seen (CVSS E:U). Re-verify against MSRC/KB when readable.","cites":["https://app.opencve.io/cve/CVE-2026-122168"]}],"documents":[{"id":118979,"url":"https://app.opencve.io/cve/CVE-2026-122168","title":"OpenCVE: CVE-2026-122168 (mirrors Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}