{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114167", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-10-20T21:56:39.318Z", "datePublished": "2026-11-10T18:15:14.893Z", "dateUpdated": "2026-11-10T19:35:21.374Z"}, "containers": {"cna": {"title": "HEVC Video Extensions Remote Code Execution Vulnerability", "datePublic": "2026-11-10T16:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:hevc_video_extensions_from_device_manufacturer:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.0.0.0", "versionEndExcluding": "2.4.149.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:hevc_video_extensions:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "2.4.151.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:hevc_video_extensions_for_licensed_appplications:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.0.0.0", "versionEndExcluding": "2.4.150.0"}]}]}], "affected": [{"vendor": "Microsoft", "product": "HEVC Video Extensions", "platforms": ["Windows 10 version 1809", "Windows 10 version 21H2", "Windows 10 version 22H2", "Windows 11 version 23H2", "Windows 11 version 24H2", "Windows 11 version 25H2", "Windows 11 version 26H1", "Windows 11 version 26H2"], "versions": [{"version": "1.0.0", "lessThan": "2.4.151.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "HEVC Video Extensions for Licensed Applications", "platforms": ["Windows 10 version 1809", "Windows 10 version 21H2", "Windows 10 version 22H2", "Windows 11 version 23H2", "Windows 11 version 24H2", "Windows 11 version 25H2", "Windows 11 version 26H1", "Windows 11 version 26H2"], "versions": [{"version": "2.0.0.0", "lessThan": "2.4.150.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "HEVC Video Extensions from Device Manufacturer", "platforms": ["Windows 10 version 1809", "Windows 10 version 21H2", "Windows 10 version 22H2", "Windows 11 version 23H2", "Windows 11 version 24H2", "Windows 11 version 25H2", "Windows 11 version 26H1", "Windows 11 version 26H2"], "versions": [{"version": "2.0.0.0", "lessThan": "2.4.149.0", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-122: Heap-based Buffer Overflow", "lang": "en-US", "type": "CWE", "cweId": "CWE-122"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-11-10T19:35:21.374Z"}, "references": [{"name": "HEVC Video Extensions Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114167"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}}}

{}

{"affected": [{"affectedData": [{"platforms": ["Windows 10 version 1809", "Windows 10 version 21H2", "Windows 10 version 22H2", "Windows 11 version 23H2", "Windows 11 version 24H2", "Windows 11 version 25H2", "Windows 11 version 26H1", "Windows 11 version 26H2"], "product": "HEVC Video Extensions", "vendor": "Microsoft", "versions": [{"lessThan": "2.4.151.0", "status": "affected", "version": "1.0.0", "versionType": "custom"}]}, {"platforms": ["Windows 10 version 1809", "Windows 10 version 21H2", "Windows 10 version 22H2", "Windows 11 version 23H2", "Windows 11 version 24H2", "Windows 11 version 25H2", "Windows 11 version 26H1", "Windows 11 version 26H2"], "product": "HEVC Video Extensions for Licensed Applications", "vendor": "Microsoft", "versions": [{"lessThan": "2.4.150.0", "status": "affected", "version": "2.0.0.0", "versionType": "custom"}]}, {"platforms": ["Windows 10 version 1809", "Windows 10 version 21H2", "Windows 10 version 22H2", "Windows 11 version 23H2", "Windows 11 version 24H2", "Windows 11 version 25H2", "Windows 11 version 26H1", "Windows 11 version 26H2"], "product": "HEVC Video Extensions from Device Manufacturer", "vendor": "Microsoft", "versions": [{"lessThan": "2.4.149.0", "status": "affected", "version": "2.0.0.0", "versionType": "custom"}]}], "source": "secure@microsoft.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally."}], "id": "CVE-2026-114167", "lastModified": "2026-11-10T19:19:10.507", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Primary"}]}, "published": "2026-11-10T19:19:10.397", "references": [{"source": "secure@microsoft.com", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114167"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "secure@microsoft.com", "type": "Primary"}]}

{}

{}