Microsoft disclosed CVE-2026-69408, an integer overflow in Windows Media Foundation that the vendor rates CVSS 9.8 and describes as allowing unauthenticated code execution over a network, affecting virtually every supported Windows client and server release.
What Is It
CVE-2026-69408 is an integer overflow or wraparound condition in Microsoft Windows Media Foundation. Per Microsoft's advisory, the flaw "allows an unauthorized attacker to execute code over a network." The CVE was published on 2026-09-08 by Microsoft's security response center and currently carries a vulnerability status of "Awaiting Analysis" at NVD, meaning the severity and impact characterization below rests on the vendor's own assessment and has not yet been independently scored.
Why It Matters
Microsoft rates the issue CVSS 3.1 base score 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. As scored by the vendor, every factor in that vector points the wrong direction for defenders: the attack is described as network-reachable and low complexity, requiring no privileges and no user interaction, with high impact to confidentiality, integrity, and availability alike. If the vector holds in practice, an unauthenticated attacker reaching an affected system over the network could achieve code execution with no victim action required.
That profile is a reason to prioritize the patch, not a description of observed attacker behavior. No public exploit code, proof of concept, or in-the-wild exploitation is documented in the source material, and the CVE does not appear in CISA's Known Exploited Vulnerabilities catalog as of this writing. Technical details of the overflow, the specific affected codec path, the reachability of the vulnerable code from untrusted input, and whether any practical network-facing trigger exists, are not published, so the real-world difficulty of exploitation remains unknown. Media Foundation parsing bugs have historically been reached through file and stream handling rather than listening network services, which may constrain how the network attack vector is realized in practice.
What's Vulnerable
Microsoft lists an unusually broad affected footprint spanning client and server, 32-bit, x64, and ARM64 platforms:
- Windows 10: Versions 1607, 1809, 21H2, and 22H2
- Windows 11: Versions 23H2, 24H2, 25H2, and 26H1
- Windows Server: 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations
Each product is affected from its base build up to a specific fixed build. Examples: Windows 10 1607 and Server 2016 below 10.0.14393.9512; Windows 10 22H2 below 10.0.19045.7725; Windows Server 2022 below 10.0.20348.5622; Server 2012 below 6.2.9200.26349; Server 2012 R2 below 6.3.9600.23397. Windows 11 24H2 and Windows Server 2025 both ship from the shared 26100 servicing branch and take the same 26100-series fixed build, which administrators should read directly from Microsoft's advisory rather than tracking as two separate targets.
Patch Status
Fixed builds are enumerated in Microsoft's advisory for each affected product. Administrators should apply the September 2026 Microsoft update for their specific Windows version and confirm the resulting build number meets or exceeds the fixed build listed in the advisory. Given the unauthenticated network-facing profile Microsoft assigns to the issue, patching is worth prioritizing on internet-exposed and remotely accessible systems first, even absent any evidence of active exploitation. No vendor-supplied workaround or mitigation is listed in the source material.
Sources
- Microsoft Security Response Center; CVE-2026-69408: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69408
- NVD, CVE-2026-69408: https://nvd.nist.gov/vuln/detail/CVE-2026-69408