Heap-Based Buffer Overflow Enables Local Code Execution in Microsoft HEVC Video Extensions

Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.

• Microsoft HEVC Video Extensions: versions from 1.0.0 through less than 2.4.87.0 are affected. Microsoft provides a fix at 2.4.87.0.
• Microsoft HEVC Video Extensions for Licensed Applications: versions from 2.0.0.0 through less than 2.4.85.0 are affected. Microsoft provides a fix at 2.4.85.0.
• Microsoft HEVC Video Extensions from Device Manufacturer: the normalized record lists versions from 2.0.0.0 through less than 2.4.86.0 as affected. Microsoft's CSAF further separates this product into multiple branches, with some branches affected below 2.5.25.0 and fixed at 2.4.86.0, while other branches are fixed at 2.5.25.0. The exact Device Manufacturer package or channel must therefore be identified before determining whether an installation is remediated.
• The status of branches or codec products not listed in these sources is not established.

Microsoft Windows Codecs Library contains a heap-based buffer overflow, classified as CWE-122, in the affected HEVC packages. The available record does not identify the specific parsing routine, buffer, file format, or attacker-controlled field involved. Exploitation requires local reachability and user interaction, has low complexity, and does not require prior privileges. The record confirms local code execution but does not specify the process, resulting privilege level, or exact security boundary. The confirmed scope is limited to the listed HEVC package branches; the status of other codec products is not established.

The issue is described as locally reachable, not as directly exploitable over a network. Exploitation has low complexity, requires no prior privileges, and requires user interaction. The supplied record identifies no public exploit. In-the-wild exploitation status is not established because known_exploited has no confirming value; this should not be interpreted as evidence that exploitation has not occurred. No exploit steps, payload, or specific indicators are provided by the available evidence.

The flaw may lead to attacker-controlled code execution within the local context of an affected system. The supplied impact attributes indicate potential effects on confidentiality, integrity, and availability, but the record does not identify the process or token under which the code would run. There is no evidence that the flaw itself provides network exploitation, cross-system propagation, or a changed security scope. User interaction remains required, while prior privileges are not required. If exploitation succeeds, realistic organisational consequences include loss of endpoint control, data modification, or local service disruption.

• Successful exploitation could allow code to run on a local endpoint and potentially affect confidentiality, integrity, or availability.
• The issue is not described as directly network-reachable, but it remains relevant on endpoints that process HEVC content where a user can be induced to interact.
• The effective privilege of executed code depends on the calling process and is not identified by the source.
• The record provides no evidence of a breach, data disclosure, or named campaign; these are possible consequences, not confirmed events.

1. Update HEVC Video Extensions to 2.4.87.0.
2. Update HEVC Video Extensions for Licensed Applications to 2.4.85.0.
3. For HEVC Video Extensions from Device Manufacturer, apply the update for the applicable package branch: 2.4.86.0 for branches mapped by Microsoft to that fix, or 2.5.25.0 for branches mapped to that fix. Do not apply one threshold universally to all Device Manufacturer channels.
4. Verify the post-update version through software inventory or package metadata, then remediate endpoints that remain within an affected range.
5. No specific alternative mitigation is documented in the available evidence. If updating is not immediately possible, follow Microsoft's guidance for the exact package and assess restrictions on HEVC content processing as an operational precaution, not as a confirmed fix.

1. Inventory HEVC Video Extensions, HEVC Video Extensions for Licensed Applications, and HEVC Video Extensions from Device Manufacturer on Windows endpoints.
2. Record the actual product name, distribution channel, and installed package version rather than relying only on the Windows version.
3. Compare each installed version with the affected boundaries and corresponding fixes in affected_summary, with particular attention to Device Manufacturer branches.
4. Verify that the security update is installed and that the post-update package version is reflected in software inventory.
5. During incident review, consider telemetry for user interaction and unusual code execution associated with applications that use the codec. This is precautionary monitoring only because no CVE-specific log event or indicator was provided.