Main Vulnerability Database Vulnerabilities #VU165184

Heap-based buffer overflow in Microsoft products - CVE-2026-114165

Published: November 11, 2026

Vulnerability identifier: #VU165184

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-114165

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the victim's system.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Windows Codecs Library when processing crafted media content. A remote attacker can trick a victim into opening a specially crafted file to execute arbitrary code on the victim's system.

Affected software

HEVC Video Extensions from Device Manufacturer
HEVC Video Extensions for Licensed Applications
HEVC Video Extensions

How to mitigate CVE-2026-114165

Install security update from vendor's website.

HEVC Video Extensions from Device Manufacturer - addressed in versions 2.4.149.0, 2.5.48.0
HEVC Video Extensions for Licensed Applications - update to 2.4.150.0
HEVC Video Extensions - update to 2.4.151.0

External References

Related Security Bulletins