CVE-2026-58599 - Vulnerability Details - OpenCVE

Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Microsoft	Hevc Video Extensions Hevc Video Extensions For Licensed Appplications Hevc Video Extensions From Device Manufacturer

No data.

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58599

History

Wed, 09 Sep 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 08 Sep 2026 17:30:00 +0000

Type	Values Removed	Values Added
Description		Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.
Title		HEVC Video Extensions Remote Code Execution Vulnerability
First Time appeared		Microsoft Microsoft hevc Video Extensions Microsoft hevc Video Extensions For Licensed Appplications Microsoft hevc Video Extensions From Device Manufacturer
Weaknesses		CWE-122
CPEs		cpe:2.3:a:microsoft:hevc_video_extensions:::::::: cpe:2.3:a:microsoft:hevc_video_extensions_for_licensed_appplications:::::::: cpe:2.3:a:microsoft:hevc_video_extensions_from_device_manufacturer::::::::
Vendors & Products		Microsoft Microsoft hevc Video Extensions Microsoft hevc Video Extensions For Licensed Appplications Microsoft hevc Video Extensions From Device Manufacturer
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58599
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2026-09-08T17:16:52.655Z

Updated: 2026-09-10T23:09:28.368Z

Reserved: 2026-07-01T18:03:43.124Z

Link: CVE-2026-58599

Vulnrichment

Updated: 2026-09-09T15:41:57.293Z

NVD

Status : Awaiting Analysis

Published: 2026-09-08T18:17:43.797

Modified: 2026-09-09T17:17:24.497

Link: CVE-2026-58599

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58599", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-07-01T18:03:43.124Z", "datePublished": "2026-09-08T17:16:52.655Z", "dateUpdated": "2026-09-10T23:09:28.368Z"}, "containers": {"cna": {"title": "HEVC Video Extensions Remote Code Execution Vulnerability", "datePublic": "2026-09-08T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:hevc_video_extensions:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "2.4.87.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:hevc_video_extensions_for_licensed_appplications:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.0.0.0", "versionEndExcluding": "2.4.85.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:hevc_video_extensions_from_device_manufacturer:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.0.0.0", "versionEndExcluding": "2.4.86.0"}]}]}], "affected": [{"vendor": "Microsoft", "product": "HEVC Video Extensions", "versions": [{"version": "1.0.0", "lessThan": "2.4.87.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "HEVC Video Extensions for Licensed Applications", "versions": [{"version": "2.0.0.0", "lessThan": "2.4.85.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "HEVC Video Extensions from Device Manufacturer", "platforms": ["Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for x64-based Systems", "Windows 10 Version 21H2 for 32-bit Systems", "Windows 10 Version 21H2 for ARM64-based Systems", "Windows 10 Version 21H2 for x64-based Systems", "Windows 10 Version 22H2 for 32-bit Systems", "Windows 10 Version 22H2 for ARM64-based Systems", "Windows 10 Version 22H2 for x64-based Systems", "Windows 11 Version 23H2 for ARM64-based Systems", "Windows 11 Version 23H2 for x64-based Systems", "Windows 11 Version 24H2 for ARM64-based Systems", "Windows 11 Version 24H2 for x64-based Systems", "Windows 11 Version 25H2 for ARM64-based Systems", "Windows 11 Version 25H2 for x64-based Systems", "Windows 11 Version 26H1 for ARM64-based Systems", "Windows 11 version 26H1 for x64-based Systems", "Windows Server 2019", "Windows Server 2019 (Server Core installation)", "Windows Server 2022", "Windows Server 2022 (Server Core installation)", "Windows Server 2025", "Windows Server 2025 (Server Core installation)"], "versions": [{"version": "2.0.0.0", "lessThan": "2.4.86.0", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-122: Heap-based Buffer Overflow", "lang": "en-US", "type": "CWE", "cweId": "CWE-122"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-09-10T23:09:28.368Z"}, "references": [{"name": "HEVC Video Extensions Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58599"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-09T15:41:56.589167Z", "id": "CVE-2026-58599", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-09T16:07:56.191Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-58599", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-09T15:41:56.589167Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-09T15:41:57.293Z"}}], "cna": {"title": "HEVC Video Extensions Remote Code Execution Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "HEVC Video Extensions", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "2.4.87.0", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "HEVC Video Extensions for Licensed Applications", "versions": [{"status": "affected", "version": "2.0.0.0", "lessThan": "2.4.85.0", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "HEVC Video Extensions from Device Manufacturer", "versions": [{"status": "affected", "version": "2.0.0.0", "lessThan": "2.4.86.0", "versionType": "custom"}], "platforms": ["Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for x64-based Systems", "Windows 10 Version 21H2 for 32-bit Systems", "Windows 10 Version 21H2 for ARM64-based Systems", "Windows 10 Version 21H2 for x64-based Systems", "Windows 10 Version 22H2 for 32-bit Systems", "Windows 10 Version 22H2 for ARM64-based Systems", "Windows 10 Version 22H2 for x64-based Systems", "Windows 11 Version 23H2 for ARM64-based Systems", "Windows 11 Version 23H2 for x64-based Systems", "Windows 11 Version 24H2 for ARM64-based Systems", "Windows 11 Version 24H2 for x64-based Systems", "Windows 11 Version 25H2 for ARM64-based Systems", "Windows 11 Version 25H2 for x64-based Systems", "Windows 11 Version 26H1 for ARM64-based Systems", "Windows 11 version 26H1 for x64-based Systems", "Windows Server 2019", "Windows Server 2019 (Server Core installation)", "Windows Server 2022", "Windows Server 2022 (Server Core installation)", "Windows Server 2025", "Windows Server 2025 (Server Core installation)"]}], "datePublic": "2026-09-08T14:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58599", "name": "HEVC Video Extensions Remote Code Execution Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:hevc_video_extensions:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.4.87.0", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:microsoft:hevc_video_extensions_for_licensed_appplications:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.4.85.0", "versionStartIncluding": "2.0.0.0"}, {"criteria": "cpe:2.3:a:microsoft:hevc_video_extensions_from_device_manufacturer:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.4.86.0", "versionStartIncluding": "2.0.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-09-10T23:09:28.368Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58599", "state": "PUBLISHED", "dateUpdated": "2026-09-10T23:09:28.368Z", "dateReserved": "2026-07-01T18:03:43.124Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-09-08T17:16:52.655Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "HEVC Video Extensions", "vendor": "Microsoft", "versions": [{"lessThan": "2.4.87.0", "status": "affected", "version": "1.0.0", "versionType": "custom"}]}, {"product": "HEVC Video Extensions for Licensed Applications", "vendor": "Microsoft", "versions": [{"lessThan": "2.4.85.0", "status": "affected", "version": "2.0.0.0", "versionType": "custom"}]}, {"platforms": ["Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for x64-based Systems", "Windows 10 Version 21H2 for 32-bit Systems", "Windows 10 Version 21H2 for ARM64-based Systems", "Windows 10 Version 21H2 for x64-based Systems", "Windows 10 Version 22H2 for 32-bit Systems", "Windows 10 Version 22H2 for ARM64-based Systems", "Windows 10 Version 22H2 for x64-based Systems", "Windows 11 Version 23H2 for ARM64-based Systems", "Windows 11 Version 23H2 for x64-based Systems", "Windows 11 Version 24H2 for ARM64-based Systems", "Windows 11 Version 24H2 for x64-based Systems", "Windows 11 Version 25H2 for ARM64-based Systems", "Windows 11 Version 25H2 for x64-based Systems", "Windows 11 Version 26H1 for ARM64-based Systems", "Windows 11 version 26H1 for x64-based Systems", "Windows Server 2019", "Windows Server 2019 (Server Core installation)", "Windows Server 2022", "Windows Server 2022 (Server Core installation)", "Windows Server 2025", "Windows Server 2025 (Server Core installation)"], "product": "HEVC Video Extensions from Device Manufacturer", "vendor": "Microsoft", "versions": [{"lessThan": "2.4.86.0", "status": "affected", "version": "2.0.0.0", "versionType": "custom"}]}], "source": "secure@microsoft.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally."}], "id": "CVE-2026-58599", "lastModified": "2026-09-09T17:17:24.497", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58599", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-09T15:41:56.589167Z", "version": "2.0.3"}}]}, "published": "2026-09-08T18:17:43.797", "references": [{"source": "secure@microsoft.com", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58599"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "secure@microsoft.com", "type": "Secondary"}]}