CVE-2026-114167

HighCVSS 7.8/10Last modified Nov 10, 2026

Description

Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
MicrosoftHEVC Video Extensions>= 1.0.0, < 2.4.151.0
MicrosoftHEVC Video Extensions for Licensed Applications>= 2.0.0.0, < 2.4.150.0
MicrosoftHEVC Video Extensions from Device Manufacturer>= 2.0.0.0, < 2.4.149.0

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1141698.8Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.CVE-2026-114177.3OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor wCVE-2026-1141707.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-1141718.8User interface (ui) misrepresentation of critical information in Visual Studio Code allows an unauthorized attacker to bypass a security feaCVE-2026-1141735.3The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenCVE-2026-1141755.4Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control SCVE-2026-1141764.3Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control SCVE-2026-1141778.8Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This iCVE-2026-1141787.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cachCVE-2026-1141797.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-CVE-2026-1141805.3Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This isCVE-2026-1141815.3Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Inco
CVE-2026-114167: High severity, CVSS 7.8 | Vulnix