CVE-2026-81352 is a high severity (CVSS 8.8) heap based buffer overflow in the Microsoft Windows Codecs Library. An unauthorized attacker could execute code over a network, and the vector needs the user to take an action. Microsoft ships the fix through its update; check the Security Update Guide for your build.
What's affected
- Windows 10 versions 21H2 and 22H2, and Windows 11 versions 23H2, 24H2, 25H2 and 26H1, as listed in the record.
- The Microsoft Web Media Extensions package, also listed in the record.
- Fixed by the Microsoft security update for your build. We could not read the Microsoft Security Update Guide page, because it needs JavaScript, so the product list and wording come from the CVE record. Open the Microsoft page for the exact update package for your build.
Record severity: CVSS 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness class is CWE-122, Heap-based Buffer Overflow.
How to check if you're exposed
Check your Windows build with winver and compare against the update listed for it in the Microsoft guide. Get-HotFix in PowerShell lists installed updates. For the Store packaged extension, Get-AppxPackage *WebMediaExtensions* shows the installed version, and the Microsoft Store updates it. Use your endpoint management tool to report patch levels across the fleet.
What to do now
- Open the Microsoft Security Update Guide entry for the CVE and note the update for each Windows build you run.
- Deploy the update through Windows Update, WSUS or your endpoint manager.
- Update the Web Media Extensions package through the Microsoft Store or your app deployment tool.
- Prioritize devices that open media from email, chat and the web.
- Verify the patch level after reboot.
Why it matters
A heap based buffer overflow (CWE-122) happens when code writes more data into a memory buffer than it was sized for. In a codec library, the data comes from a media file, so a malformed file can corrupt memory around the buffer. That is the usual route to code execution.
The CVSS vector shows network delivery with user interaction, so the user must open or preview something. The record does not mark this CVE as exploited in the wild. Codec libraries are shared by many applications, which is why patching the OS component matters more than any single app.
Quick check
Does the user need to do something?
The vector in the record includes user interaction.
Where is the fixed version?
In the Microsoft update for your Windows build; check the Security Update Guide.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
