Cyber & AI intelligence
Wasteland.
Briefs indexed2597
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-69715 2026-09-08

CVE-2026-69715: Critical Windows DirectShow Out-of-Bounds Read Enables Remote Code Execution

"Microsoft disclosed CVE-2026-69715, a CVSS 9.8 out-of-bounds read in Windows DirectShow that lets an unauthenticated attacker execute code over a network across nearly every supported Windows client and server release."

Microsoft disclosed CVE-2026-69715, a CVSS 9.8 out-of-bounds read in Windows DirectShow that lets an unauthenticated attacker execute code over a network across nearly every supported Windows client and server release.

What Is It

CVE-2026-69715 is an out-of-bounds read in Windows DirectShow that allows an unauthorized attacker to execute code over a network. It was published by Microsoft (MSRC) on 2026-09-08 and currently carries an NVD status of "Awaiting Analysis."

The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, scoring 9.8 (CRITICAL). That vector describes the worst realistic combination: network-reachable, low attack complexity, no privileges, and no user interaction, with total loss of confidentiality, integrity, and availability.

Why It Matters

Remote code execution with no authentication and no user interaction is the highest-priority class of Windows bug. The 9.8 rating and the "unauthorized attacker" language in Microsoft's description indicate that neither credentials nor user interaction are required as scored.

That said, the CVSS vector reflects how the flaw was scored, not a demonstrated attack path. Microsoft has not published technical detail on how untrusted input reaches the flawed DirectShow parsing path, and no public analysis or proof-of-concept is available. Which listening services, applications, or media-handling components actually expose that path to remote network input is therefore unclear, and real-world exposure may prove narrower than the vector implies. Defenders should not wait on that clarification to patch, but they should treat statements about the specific remote reachability of the parser as unconfirmed until MSRC or independent researchers publish more.

As of publication, CVE-2026-69715 does not appear in the CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog). There is no confirmation of active exploitation, and no CISA-mandated remediation deadline applies at this time. Severity alone justifies treating it as an emergency patch item.

What's Vulnerable

Microsoft lists the following affected products and fixed builds:

The two 26100 entries cannot both be correct. Windows 11 24H2 and Windows Server 2025 ship from the same 10.0.26100 servicing branch, so that branch has exactly one fixed revision; it cannot be both .9445 and .33438. At least one of those numbers is an error in the source data, and this brief does not resolve which. Do not use either value as a patch gate, a detection threshold, or a compliance baseline. Pull the authoritative 26100 build directly from the MSRC update guide entry for CVE-2026-69715 first. Every other build number in the list above is internally consistent and unaffected by this discrepancy.

32-bit, x64, and ARM64 platforms are affected depending on release, and Server Core installations are explicitly included.

Patch Status

Microsoft has shipped fixes; each affected product above has a defined fixed build number, subject to the 26100 caveat noted above. Remediation is to update to at or above the listed build via the MSRC update guide entry. No workarounds or mitigations are provided in the supplied source data.

Sources