Key points
- CVE-2026-100220 is a heap-based buffer overflow in the Windows Media Video Decoder.
- The flaw allows unauthorized attackers to execute code over a network.
- Microsoft rates the vulnerability as high severity with a CVSS score of 8.8.
Microsoft has confirmed a remote code execution vulnerability in the Windows Media Video Decoder component. The flaw, identified as CVE-2026-100220, stems from a heap-based buffer overflow. An unauthorized attacker can exploit this issue over a network to run arbitrary code on affected systems. According to the National Vulnerability Database, the flaw carries a CVSS score of 8.8, which Microsoft classifies as high severity.
In plain English
The Windows Media Video Decoder processes video files and streams on operating systems. This specific bug occurs when the decoder handles certain data inputs incorrectly. Instead of managing the memory properly, the software overflows a heap buffer. This overflow allows an attacker to inject and execute malicious code. The attacker does not need prior access to the system to trigger this exploit remotely.
The background
Several versions of Windows 10 and Windows 11 are impacted by this vulnerability. Affected Windows 10 versions include 1607, 1809, 21H2, and 22H2. Specifically, builds before 10.0.14393.9612, 10.0.17763.9376, and 10.0.19044.7807 are vulnerable. Windows 11 version 23H2 is also affected if the build is earlier than 10.0.22631.7652. The National Vulnerability Database categorizes the weakness as CWE-122.
What changes now
Microsoft has released updates to address this issue for the affected versions. Administrators must verify that their systems are running the patched build numbers listed in the advisory. Systems running older builds remain exposed to remote exploitation. This follows recent high-severity findings in other Microsoft components. As Vuln Post reported on October 14, 2026, a separate .NET flaw also enabled remote code execution on Windows.
Who needs to act first
Security teams should prioritize systems that are directly exposed to untrusted networks. Servers handling media content or public-facing endpoints require immediate attention. Before deploying updates broadly, test the patches in a isolated environment to ensure compatibility. Back up critical data and system configurations prior to applying changes. Monitor network traffic for unusual activity that might indicate exploitation attempts while rolling out fixes.
What to do and how to stay safe: Microsoft
- Identify all systems running affected Windows 10 and 11 versions using inventory tools.
- Apply the latest security updates to move systems to the patched build numbers.
- Restrict network access to media processing services where possible until patched.
- Monitor logs for signs of unauthorized remote code execution or buffer overflow attempts.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Windows versions are affected by CVE-2026-100220?
Windows 10 versions 1607, 1809, 21H2, and 22H2 before specific build numbers, and Windows 11 version 23H2 before build 10.0.22631.7652 are affected.
Is there a fix available for this vulnerability?
Yes, Microsoft has released updates for the affected versions. Systems must be updated to the specific build numbers listed in the advisory.
What is the severity rating of this flaw?
The National Vulnerability Database rates CVE-2026-100220 as high severity with a CVSS score of 8.8.
