Heap-Based Buffer Overflow Enables Local Privilege Elevation in Microsoft HEVC Video Extensions

Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to elevate privileges locally.

• Microsoft HEVC Video Extensions: affected from 1.0.0 before 2.4.87.0; Microsoft identifies 2.4.87.0 as the fixed release.
• Microsoft HEVC Video Extensions for Licensed Applications: affected from 2.0.0.0 before 2.4.85.0; the identified fixed release is 2.4.85.0.
• Microsoft HEVC Video Extensions from Device Manufacturer: the base record states affected from 2.0.0.0 before 2.4.86.0. Microsoft's current VEX data, however, describes multiple branches of this product with affected versions before 2.5.25.0, listing 2.4.86.0 as the fix for one group of branches and 2.5.25.0 as the fix for another. Therefore, 2.4.86.0 is not a universal fixed boundary for every Device Manufacturer branch.
• The recorded platform scope includes Windows 10 Version 1809, Windows 10 Version 21H2, and Windows 10 Version 22H2; Windows 11 Version 23H2, Version 24H2, Version 25H2, and version 26H1; and Windows Server 2019, Windows Server 2022, and Windows Server 2025, including the listed Server Core installations. Affected architectures vary by platform and include 32-bit, x64, and ARM64.

The confirmed weakness is CWE-122, a heap-based buffer overflow, in the Microsoft Windows Codecs Library, a component used by the affected HEVC Video Extensions variants. The attack is local, requires no prior privileges, has low complexity, and depends on user interaction. The available evidence does not identify the attacker-controlled file type, codec format, API, processing operation, or memory-allocation sequence that triggers the flaw. The weakness and high-level access conditions are therefore confirmed, but the exact trigger and code path remain unknown. The described outcome is privilege elevation within the same security scope.

• Reachability: Local access to a system with an affected component is required; the CVE data does not describe a remote attack path.
• Authentication and privileges: No prior privileges are required.
• User interaction: Required.
• Complexity: Low according to Microsoft's assessment.
• Exploitation status: The supplied record marks public exploit availability as false. Actual exploitation is not established by the available data, while Microsoft's VEX classifies exploit code maturity as unproven. This does not prove that exploitation has never occurred.

The flaw can result in local privilege elevation after the triggering condition is successfully processed. The recorded impact indicates potential effects on confidentiality, integrity, and availability of resources on the same system. The scope is unchanged, so the described consequences remain within the security authority of the compromised host rather than automatically crossing into another security domain. Required user interaction reduces the likelihood of fully unattended exploitation, but it does not remove risk on systems where users process codec-related content. Public detail does not establish the exploit primitive, the exact resulting privilege level, or persistence capability.

Successful exploitation could allow an attacker to elevate privileges on the same Windows system and potentially read data, modify content, or disrupt resources available to the resulting privileged context. This could turn limited local access into broader control of the affected host. The requirement for user interaction means exposure depends in part on users processing content or performing actions that involve the codec component. The available data does not establish a remote-access scenario, a specific campaign, named victims, or a confirmed breach.

1. Apply Microsoft's security update for each affected variant. For HEVC Video Extensions, update to 2.4.87.0; for HEVC Video Extensions for Licensed Applications, update to 2.4.85.0.
2. For HEVC Video Extensions from Device Manufacturer, apply the branch-specific update: 2.4.86.0 for the branches Microsoft maps to that release and 2.5.25.0 for the branches Microsoft maps to that release.
3. After updating, verify the variant name, product branch, and installed package version on each device. Do not treat 2.4.86.0 as sufficient for every Device Manufacturer build.
4. Prioritize systems where users handle media content or software may invoke the Windows Codecs Library. This is risk prioritization, not a substitute for patching.
5. The available evidence does not provide a Microsoft-validated workaround. Temporary compensating controls should not be treated as eliminating the vulnerability.

1. Inventory Microsoft Store or application packages for HEVC Video Extensions, HEVC Video Extensions for Licensed Applications, and HEVC Video Extensions from Device Manufacturer.
2. Compare installed package versions with the affected boundaries and corresponding fixed releases listed in affected_summary.
3. For HEVC Video Extensions from Device Manufacturer, identify the exact product branch before determining patch status. Do not assume that one fixed release applies to every branch of this product.
4. Check update deployment status on Windows 10, Windows 11, and Windows Server systems within the listed product scope.
5. The available evidence does not provide a specific IOC, log event, or triggering file. General monitoring is therefore precautionary, and the absence of suspicious log evidence does not establish safety.