CVE-2026-57090 is a high severity (CVSS 8.8) heap based buffer overflow in Windows Media Foundation. The record says an unauthorized attacker can execute code over a network. Install the Windows security update listed in Microsoft's Security Update Guide for your edition.
What's affected
Microsoft lists many Windows editions for this record, from Windows 10 1607 through Windows 11 26h1, and Windows Server 2012 among others. The record lists the affected Windows editions but no build numbers, and its only reference is the Microsoft Security Update Guide entry, which needs JavaScript to display. I could not read the fix details for this post.
The CVSS vector is AV:N/AC:L/PR:N/UI:R with high impact on confidentiality, integrity and availability. The required user action, such as opening media content, is why the base score is 8.8 and not higher.
How to check if you're exposed
Check which security update your machines have.
winver
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
- Open the Microsoft Security Update Guide entry and find the update for your Windows edition and build.
- Use your patch management tool or Windows Update reports to see which devices are missing it.
- Prioritize servers and internet facing systems.
What to do now
- Open the Microsoft Security Update Guide entry for CVE-2026-57090 and note the update for each Windows edition you run.
- Deploy the update through your normal patch process, workstations first since users open media files and web content.
- Remind users not to open media files from unknown sources.
- Keep endpoint protection signatures current.
- Confirm the installed update on a sample of machines after rebooting.
Why it matters
The weakness is CWE-122, heap based buffer overflow. Media parsers read complex file formats from untrusted sources, which makes them a regular source of memory safety bugs. Writing past a buffer on the heap can corrupt data and, with effort, redirect execution.
The user interaction requirement means the exposure is mostly through documents, downloads and web pages. Timely patching of Windows is the best control. The record is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Why does a user have to act?
The vector lists user interaction as required, which fits an attack that needs someone to open or load crafted content.
Sources
Last reviewed: 19 October 2026.
