---
id: "CVE-2026-88229"
page: "https://infrastack.ai/live/CVE-2026-88229"
kind: "vulnerability"
aliases: ["CVE-2026-88229"]
title: "Windows Media Player: heap overflow lets a network attacker run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Windows Media Player", "fixed": [], "affected": "Windows 10 1607/Server 2016 <= 10.0.14393.9688; 1809/Server 2019 <= 10.0.17763.9487; 21H2 <= 10.0.19044.7846; 22H2 <= 10.0.19045.7846; Server 2022 <= 10.0.20348.5870; Windows 11 23H2 <= 10.0.22631.7711; 24H2 <= 10.0.26100.9974; 25H2 <= 10.0.26200.9974; 26H1 <= 10.0.28000.3501; 26H2 <= 10.0.26300.9974; Server 2025 <= 10.0.26100.33822", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["other", "user-interaction", "windows", "windows-media-player"]
not_affected_if: []
published_at: "2026-11-10T19:21:31+00:00"
first_seen_at: "2026-11-10T19:25:19+00:00"
updated_at: "2026-11-10T20:45:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88229", "first_seen_at": "2026-11-10T19:25:19+00:00"}, {"source": "analyst", "url": "https://cve.report/CVE-2026-88229", "first_seen_at": "2026-11-10T20:45:55+00:00", "cites": ["https://cve.report/CVE-2026-88229"]}]
exploit_sources: []
---

# Windows Media Player: heap overflow lets a network attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-88229 (this .md is for agents)

Heap-based buffer overflow in Windows Media Player lets an unauthenticated attacker run code over a network. CVSS 8.8 (AV:N/AC:L/PR:N/UI:R): the user has to open a crafted file or stream. Microsoft's CNA record lists Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 to 26H2) and Windows Server 2016 to 2025 as affected up to specific builds. No exploitation or public PoC found; the CVE record rates exploit code maturity as unproven (E:U).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Media Player affected Windows 10 1607/Server 2016 <= 10.0.14393.9688; 1809/Server 2019 <= 10.0.17763.9487; 21H2 <= 10.0.19044.7846; 22H2 <= 10.0.19045.7846; Server 2022 <= 10.0.20348.5870; Windows 11 23H2 <= 10.0.22631.7711; 24H2 <= 10.0.26100.9974; 25H2 <= 10.0.26200.9974; 26H1 <= 10.0.28000.3501; 26H2 <= 10.0.26300.9974; Server 2025 <= 10.0.26100.33822 fixed no fixed version listed

## How to check

Run winver or [System.Environment]::OSVersion in PowerShell and compare the build with the list: affected is at or below 10.0.14393.9688 (1607/Server 2016), 10.0.17763.9487 (1809/Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.20348.5870 (Server 2022), 10.0.22631.7711 (11 23H2), 10.0.26100.9974 (11 24H2), 10.0.26200.9974 (11 25H2), 10.0.28000.3501 (11 26H1), 10.0.26300.9974 (11 26H2), 10.0.26100.33822 (Server 2025). Confirm the exact fixed build in the MSRC Security Update Guide entry.

## Timeline

- 2026-11-10T19:25:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88229
- 2026-11-10T20:45:55+00:00 analyst https://cve.report/CVE-2026-88229 — MSRC page is JS-only and unreadable here; used the CVE record mirror (cve.report, Microsoft CNA data). Nothing verified. Fixed KB/builds not read; the CNA lists builds up to which Windows is affected.

## Documents

- [describes] CVE-2026-88229 (CVE record mirror, Microsoft CNA data) https://cve.report/CVE-2026-88229

## From the sources

Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_