CVE-2026-108400: HEVC Video Extensions Remote Code Execution Vulnerability

Rated Critical by the Microsoft Security Response Center (MSRC), this vulnerability carries a CVSS base score of 8.8 and a CVSS temporal score of 7.7. While Microsoft currently assesses the flaw as Exploitation Less Likely, the underlying weakness allows an unauthorized attacker to execute arbitrary code if a user is persuaded to open a malicious file. Because the affected packages span retail, licensed application, and OEM-installed variants of the codec, administrators and everyday users alike need to ensure their systems have received the updated builds.

Vulnerability Overview and Official Advisory Facts​

At the core of CVE-2026-108400 is a classic arithmetic hazard tracked under CWE-190: Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.

To ensure complete clarity on how this flaw operates and how Microsoft categorizes it, here are the official advisory facts and status indicators directly from the MSRC disclosure:

• CVE ID: CVE-2026-108400
• Title: HEVC Video Extensions Remote Code Execution Vulnerability
• Severity: Critical
• CVSS Base Score: 8.8
• CVSS Temporal Score: 7.7
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness (CWE): CWE-190
• Exploitation Assessment: Exploitation Less Likely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Microsoft’s official advisory notes two critical context points regarding the nature of the bug and how an attack plays out in practice:

1. Microsoft Windows Codecs Library Remote Code Execution Vulnerability: Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
2. Target Context and User Interaction: According to the CVSS metric, the attack vector is network (AV:N) and user interaction is required (UI:R). What is the target context of the remote code execution? This attack requires a user to open a specially crafted file from the attacker to initiate remote code execution.

Section Summary: CVE-2026-108400 is a Critical remote code execution flaw rooted in an integer overflow (CWE-190) within the Microsoft Windows Codecs Library. Although it has neither been publicly disclosed nor exploited in the wild, customer action is required to remediate the risk.

Deconstructing the Technical Mechanics: CWE-190 and the CVSS Vector​

Why does an arithmetic mistake inside a video codec lead to a Critical severity rating and an 8.8 base score? Looking closely at CWE-190 (Integer Overflow or Wraparound) alongside the CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) explains the mechanics.

Based on general industry knowledge of media parser architecture, video codecs must read header metadata—such as frame dimensions, color depth, sample counts, and chunk sizes—to calculate how much memory to allocate before decoding a stream. When an integer overflow or wraparound occurs, a calculation exceeds the maximum value that a fixed-size integer variable can hold, causing the number to wrap around to a very small value (or a negative number, depending on signedness). If the library allocates a small memory buffer based on that wrapped calculation, and then proceeds to copy the full, un-wrapped payload of video data into that buffer, the extra data spills over into adjacent memory. Attackers can weaponize that memory corruption to hijack control flow and execute arbitrary instructions.

Breaking down the CVSS string highlights why defenders take this seriously:

• Attack Vector — Network (AV:N) and User Interaction — Required (UI:R): This is not a "wormable" network service flaw where an attacker can blindly send packets to an open port. Instead, as Microsoft explicitly clarifies in the advisory, the network vector reflects that the specially crafted file can be delivered remotely (such as via email, web download, or messaging share), while the UI:R metric confirms that a user must actually open the specially crafted file from the attacker to trigger code execution.
• Attack Complexity — Low (AC:L) and Privileges Required — None (PR:N): The attacker does not need prior authentication on the target machine, nor do they need to win complex race conditions once the file is opened.
• Scope — Unchanged (S:U) with High Impact (C:H/I:H/A:H): Successful exploitation occurs within the security context of the component and user opening the file, granting high impact across Confidentiality, Integrity, and Availability.
• Temporal Metrics (E:U/RL:O/RC:C): Unproven exploit maturity (E:U), the availability of an Official Fix (RL:O), and Confirmed report confidence (RC:C) bring the temporal score down from 8.8 to 7.7.

Section Summary: An integer overflow (CWE-190) during media processing can lead to memory corruption when a specially crafted file is opened. While user interaction is mandatory (UI:R), the lack of required privileges (PR:N) and the potential for complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) justify the 8.8 base score.

Affected Products, Fixed Builds, and Remediation​

One nuance of managing codec updates is that Microsoft distributes HEVC support through three distinct package identities depending on whether the extension was purchased directly, bundled for licensed applications, or pre-installed by an Original Equipment Manufacturer (OEM). Furthermore, HEVC Video Extensions from Device Manufacturer tracks two separate fixed build branches (2.4.86.0 and 2.5.25.0).

Below is the complete mapping of affected products, fixed builds, and exact remediation guidance from the MSRC advisory:

To reiterate the consolidated official remediation requirement verbatim:

For HEVC Video Extensions, update to fixed build 2.4.87.0 or later. For HEVC Video Extensions for Licensed Applications, update to fixed build 2.4.85.0 or later. For HEVC Video Extensions from Device Manufacturer, update to fixed build 2.4.86.0 or later; update to fixed build 2.5.25.0 or later.

Click to expand...

Section Summary: Three distinct HEVC Video Extensions product packages are affected by CVE-2026-108400. Depending on which package is installed, systems must be updated to fixed build 2.4.87.0 or later, 2.4.85.0 or later, or 2.4.86.0 / 2.5.25.0 or later.

Practical Guidance for Administrators and Users​

Because Customer action required: Yes applies to this advisory, organizations and individual users should verify that their installed codec packages have reached or surpassed the fixed build numbers listed above.

In environments where automatic app updates are enabled, these extensions normally update silently in the background. However, in enterprise environments where store package delivery is throttled, restricted by policy, or air-gapped, old codec builds can linger indefinitely on endpoints—especially the HEVC Video Extensions from Device Manufacturer package that often ships pre-loaded on OEM laptops and desktops.

To audit and secure your systems:

1. Inventory Installed Extensions: Check which of the three product variants—HEVC Video Extensions, HEVC Video Extensions for Licensed Applications, or HEVC Video Extensions from Device Manufacturer—is present on your endpoints.
2. Verify Build Numbers: Compare the installed version string directly against the fixed build baseline (2.4.87.0 for HEVC Video Extensions, 2.4.85.0 for HEVC Video Extensions for Licensed Applications, and 2.4.86.0 or 2.5.25.0 for HEVC Video Extensions from Device Manufacturer).
3. Maintain Caution with Untrusted Media Files: Because exploitation hinges on a user opening a specially crafted file from an attacker, standard defense-in-depth practices—such as blocking suspicious attachments and educating users not to open unexpected media files from untrusted sources—provide an essential layer of protection while updates roll out.

Section Summary: Administrators should audit endpoint app inventories to confirm that all installed variants of the HEVC extensions meet or exceed their respective fixed builds (2.4.87.0, 2.4.85.0, 2.4.86.0, or 2.5.25.0), rather than assuming OS-level patches alone cover store-delivered codec packages.