CVE-2026-48574: Windows Media Remote Code Execution Vulnerability

Synopsis

Heap-based buffer overflow in Windows Media allows an attacker with local access to execute arbitrary code on affected Windows systems. The vulnerability is reached locally and requires no authentication, but the attacker must convince a user to open a malicious media file. Successful exploitation gives the attacker full control over the affected process, including the ability to read, modify, or destroy data and install additional software. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows-based container images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the vulnerable component is required.

• AuthenticationNot required

  No account or credentials are required before triggering the overflow; the attack is launched through a crafted media file without prior login.

• Victim interactionRequired

  A user on the targeted system must open or preview a malicious media file, making social engineering a prerequisite for exploitation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race condition, memory-layout knowledge, or other environmental precondition beyond getting the victim to open the file.

Blast Radius

• The attacker executes arbitrary code in the context of the user who opened the malicious media file.
• All files readable by that user account are accessible, including documents, credentials cached on disk, and browser profile data.
• The attacker can write or overwrite files within the user's permissions, modifying application data or planting persistent malware.
• The affected media process can be crashed or held indefinitely, disrupting any service or workflow that depends on Windows Media processing.