CVE-2026-69601: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability, identified as CVE-2026-69601 and classified under CWE-122 (Heap-based Buffer Overflow), exists in Microsoft Windows Media Foundation. It affects various Windows 10 versions starting from 1607 and later builds up to specific update versions before patches were applied. The flaw allows remote attackers to execute arbitrary code without privileges and with low attack complexity, requiring user interaction. The vulnerability impacts confidentiality, integrity, and availability with high severity. Microsoft has published an official fix to remediate this issue.

Successful exploitation of this heap-based buffer overflow can lead to remote code execution by an unauthorized attacker over a network. This compromises system confidentiality, integrity, and availability, potentially allowing full control over the affected system.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69601. No additional mitigation steps are indicated beyond applying the official patches.