CVE-2026-114164: HEVC Video Extensions Remote Code Execution Vulnerability

Because High Efficiency Video Coding (HEVC) extensions sit on millions of consumer PCs and enterprise workstations—often preloaded by OEMs or installed alongside media applications—this Microsoft security patch deserves prompt attention from administrators and everyday Windows users alike. While Microsoft assesses the flaw as Exploitation Less Likely, the advisory explicitly flags that customer intervention is needed to ensure affected packages reach their patched builds.

Advisory Snapshot and Official Vulnerability Metrics​

Before diving into how media parser math goes sideways, let us establish the exact baseline telemetry recorded in the MSRC advisory for CVE-2026-114164:

• CVE ID: CVE-2026-114164
• Vulnerability Title: HEVC Video Extensions Remote Code Execution Vulnerability
• Related Advisory Component: Microsoft Windows Codecs Library Remote Code Execution Vulnerability
• Severity: Important
• CVSS Base Score: 8.8
• CVSS Temporal Score: 7.7
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness Classification: CWE-191 (Integer underflow — wrap or wraparound)
• Exploitation Assessment: Exploitation Less Likely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

According to the official MSRC description, an integer underflow (wrap or wraparound) in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. Breaking down the CVSS metric (AV:N and UI:R), why is a file-based codec flaw categorized with a network attack vector? As Microsoft clarifies in its official advisory facts, although the attack vector is network (AV:N), user interaction is required (UI:R): initiating remote code execution requires a user to open a specially crafted file delivered by the attacker—such as via email, web download, or network share.

Section Summary: CVE-2026-114164 is an Important-severity remote code execution flaw (CVSS 8.8 base, 7.7 temporal) in the Microsoft Windows Codecs Library affecting HEVC extension packages, requiring a user to open a specially crafted file and requiring customer action to remediate.

Under the Hood: CWE-191 and Codec Parsing Risks​

Why do video codecs show up so reliably in cybersecurity advisories? Synthesizing from general industry knowledge of binary media parsing, modern video formats rely on deeply nested container headers, frame dimensions, and sample size tables to squeeze high-resolution footage into compact files. Every time a user opens or previews a media file, the underlying codec library reads untrusted numbers straight out of that file's header to calculate how much memory to allocate and how many bytes to decode.

CWE-191 describes an integer underflow—also known as wrap or wraparound. In computer arithmetic, fixed-width integers have a hard floor. If a program subtracts a larger value from a smaller unsigned integer (for example, subtracting a header offset from a declared chunk length that an attacker deliberately set too small), the result does not simply stop at zero. Instead, it wraps backward around the minimum boundary and becomes a massive positive number—or, with signed integers, flips unexpectedly across boundaries.

When a codec allocates a small buffer based on one calculation and then uses a wrapped-around integer to copy frame data into that buffer, memory corruption follows immediately. Because the CVSS vector records PR:N (no privileges required), AC:L (low attack complexity), and C:H/I:H/A:H (high impact to confidentiality, integrity, and availability within an unchanged scope S:U), a successful exploit runs within the security context of the user opening the crafted file. If that user happens to be logged in with local administrator rights, the attacker inherits those keys to the kingdom.

On the bright side, the temporal vector components (E:U/RL:O/RC:C—unproven exploit maturity, official fix available, and confirmed report confidence) align with Microsoft's current status telemetry (Publicly disclosed: No, Exploited: No, and Exploitation Less Likely). That gives defenders a clean window to patch before opportunistic threat actors try to weaponize proof-of-concept media files.

Section Summary: The CWE-191 integer underflow occurs when arithmetic subtraction wraps around integer boundaries during codec processing, creating a high-impact code execution risk whenever a user opens a maliciously crafted file.

Affected Products and Fixed Build Matrix​

Microsoft distributes HEVC support across three distinct extension variants depending on whether the package was acquired directly, bundled for licensed software, or preinstalled by a PC hardware vendor. Administrators must verify which variant sits on their endpoints because each variant carries its own minimum safe build threshold.

Notice the dual branch targets on the OEM edition: HEVC Video Extensions from Device Manufacturer lists both 2.4.149.0 and 2.5.48.0 as fixed builds. Depending on the Servicing branch installed on a given device, reaching the applicable fixed build (2.4.149.0 or later on the 2.4 track, or 2.5.48.0 or later on the 2.5 track) resolves the vulnerability.

Section Summary: Three separate HEVC extension packages are affected by CVE-2026-114164, requiring updates to build 2.4.151.0 or later, 2.4.150.0 or later, or 2.4.149.0 / 2.5.48.0 or later depending on the installed variant.

Practical Remediation Guide for Windows Users and IT Admins​

Why does the MSRC record state Customer action required: Yes for an extension typically serviced through Microsoft's app delivery channels? Based on general Windows administration practice, standard monthly cumulative OS updates alone do not always update packaged codec extensions—especially in enterprise environments where Microsoft Store traffic is blocked by group policy, firewall rules, or air-gapped network controls. Could your fleet be completely up to date on OS cumulative patches while quietly running an outdated media codec? Without checking app package versions, the answer is very easily yes.

Follow these practical steps to verify exposure and apply the required remediation:

1. Audit Installed HEVC Packages via PowerShell: Open an elevated PowerShell prompt (or run an inventory script across managed endpoints) and inspect installed Appx packages matching HEVC (Get-AppxPackage -AllUsers *HEVC* | Select-Object Name, Version). Checking -AllUsers is critical on shared workstations where a provisioned or per-user package might linger on an older build under an inactive profile.
2. Compare Against Official Fixed Builds: Match the discovered product and version output against Microsoft's exact remediation targets:
   • For HEVC Video Extensions, update to fixed build 2.4.151.0 or later.
   • For HEVC Video Extensions for Licensed Applications, update to fixed build 2.4.150.0 or later.
   • For HEVC Video Extensions from Device Manufacturer, update to fixed build 2.4.149.0 or later; update to fixed build 2.5.48.0 or later.
3. Trigger Store Updates on Consumer and Connected PCs: On standalone desktops and laptops, open the Microsoft Store application, navigate to the Library section, and trigger Get updates so installed codec extensions pull the latest release.
4. Remediate Managed Enterprise Endpoints: If your organization restricts automatic Store app updates, distribute the updated HEVC package builds through your endpoint management platform—or, if HEVC playback is unnecessary on high-security servers and locked-down kiosks, evaluate removing unneeded media extension packages altogether to shrink the workstation attack surface.
5. Reinforce Safe File-Handling Habits: Because UI:R means an attacker must convince a user to open a crafted file, remind staff not to open unexpected video attachments or unfamiliar media links, and maintain least-privilege user accounts so a codec bug never runs with administrative rights.

For deeper discussions on auditing provisioned app packages, PowerShell inventory scripts, and hardening enterprise media handling, explore our Windows security patching and endpoint management threads right here on WindowsForum.com.

Section Summary: Because OS cumulative updates may not cover Store-delivered codec packages—particularly on restricted enterprise networks—administrators and users should actively audit installed HEVC builds via PowerShell or the Microsoft Store Library and ensure every endpoint meets Microsoft's fixed build thresholds.