Main Vulnerability Database Vulnerabilities #VU148159

Heap-based buffer overflow in Microsoft products - CVE-2026-58600

Published: September 9, 2026

Vulnerability identifier: #VU148159

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-58600

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to escalate privileges on the target system.

The vulnerability exists due to a boundary error in HEVC Video Extensions. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and gain elevated privileges on the system.

Affected software

HEVC Video Extensions for Licensed Applications
HEVC Video Extensions from Device Manufacturer
HEVC Video Extensions

How to mitigate CVE-2026-58600

Install updates from vendor's website.

HEVC Video Extensions for Licensed Applications - update to 2.4.85.0
HEVC Video Extensions from Device Manufacturer - addressed in versions 2.4.86.0, 2.5.25.0
HEVC Video Extensions - update to 2.4.87.0

External References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58600

Related Security Bulletins