Skip to content
Centoculus
en

Security alert · Critical

Windows Media Foundation: critical remote code execution flaw (CVE-2026-96157)

· 2 minutes read · Centoculus Security Team

Known since

Affected: Microsoft Windows Media Foundation (catalogue product: Microsoft Exchange); for affected versions, see Microsoft's advisory

What happened

On 10 November 2026, Microsoft published CVE-2026-96157, a heap-based buffer overflow in Windows Media Foundation. According to the description, an unauthorized attacker can use it to execute code over a network. The vulnerability has a CVSS base score of 9.8 (critical).

CISA does not list the vulnerability as exploited, and none of the available sources report attacks. The available data contains no further technical details.

Who is affected

The description names Windows Media Foundation. This is the multimedia component of Windows, and it is also present on Windows Server. The catalogue entry, however, lists Microsoft Exchange as the product. Our sources do not say which Windows or Exchange versions are affected, and Microsoft's advisory page did not show any details when we checked it. Microsoft's advisory (linked below) lists the affected products and versions. Use that list to see which of your systems are in scope rather than assuming every Windows machine is.

Linux servers and other non-Windows systems are not affected.

What to do now

  1. Open Microsoft's advisory for CVE-2026-96157 (linked below). Note which Windows and Exchange versions are listed and which security updates (KB numbers) fix them.
  2. Install those updates on all affected systems, starting with servers that are reachable from the internet and Exchange servers. You can use Windows Update, WSUS or your patch management tool.
  3. Restart the systems if the update asks for it. Afterwards, check that your services (IIS, Exchange, applications) are running again.
  4. Until all systems are patched, keep network access to Windows servers as narrow as possible. Only expose the services you really need.

How to check whether you are affected

  • Compare the build number of each system (run winver, or Get-ComputerInfo | Select-Object OsName, OsBuildNumber in PowerShell) with the versions listed in Microsoft's advisory.
  • Check whether the KB update listed in the advisory is installed: Get-HotFix -Id KBxxxxxxx in PowerShell, using the KB number from the advisory.
  • For Exchange servers, also check the installed Exchange build against the advisory.

Sources

More on Microsoft Exchange

Related posts