CVE-2026-72960: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-72960) involves a heap-based buffer overflow in Windows Media Player on Windows 10 Version 1607 and subsequent versions. An attacker can exploit this flaw remotely to execute arbitrary code, potentially gaining control over the affected system. The vulnerability affects multiple Windows 10 builds starting from 10.0.14393.0 up to various upper bounds before patched versions. Microsoft has published an official security update to remediate this issue.

Successful exploitation of this heap-based buffer overflow can lead to remote code execution with high impact on confidentiality, integrity, and availability of the affected system. An attacker could run arbitrary code in the context of the current user, potentially leading to full system compromise.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Windows 10 Version 1607 and later to remediate this vulnerability. Refer to the Microsoft security update guide for CVE-2026-72960 for detailed patch information.