CVE-2025-48805: Windows 10 Buffer Overflow Vulnerability

CVE-2025-48805 Overview

CVE-2025-48805 is a heap-based buffer overflow vulnerability in the Microsoft MPEG-2 Video Extension. An authorized local attacker can trigger the flaw to execute arbitrary code on affected Windows systems. The vulnerability affects a broad range of Microsoft Windows client and server releases, from Windows 10 1507 through Windows 11 24H2, and from Windows Server 2008 through Windows Server 2025. Microsoft assigned this issue two CWE categories: [CWE-122] Heap-based Buffer Overflow and [CWE-787] Out-of-bounds Write. The CVSS 3.1 base score is 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting local attack vector and high impact to confidentiality, integrity, and availability.

Critical Impact
A local authorized attacker can leverage a crafted MPEG-2 video stream to corrupt heap memory in the Microsoft MPEG-2 Video Extension and gain code execution in the context of the affected user process.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-07-08 - CVE-2025-48805 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48805

Vulnerability Analysis

The Microsoft MPEG-2 Video Extension is a codec component distributed through the Microsoft Store that enables Windows applications to decode MPEG-2 video streams. CVE-2025-48805 is a heap-based buffer overflow ([CWE-122]) that also manifests as an out-of-bounds write ([CWE-787]). Exploitation requires local access and low-level user privileges, and no user interaction is needed once the malicious content is processed. Successful exploitation results in arbitrary code execution within the process consuming the MPEG-2 content. Because the impact spans confidentiality, integrity, and availability, an attacker can read memory, tamper with process state, and crash the host application.

Root Cause

The flaw stems from improper bounds validation when the MPEG-2 decoder parses structured video data on the heap. Fields within the crafted stream cause the parser to write past the boundary of an allocated heap buffer. This corrupts adjacent heap metadata or object pointers, giving the attacker control over subsequent memory operations.

Attack Vector

An authorized user must supply a malicious MPEG-2 file to an application that invokes the vulnerable extension. Delivery scenarios include opening a crafted .mpg or .ts file from local storage, a mapped network share, or a removable device. Once the decoder processes the file, the heap overflow is triggered and the attacker gains code execution at the privilege level of the calling process.

No public proof-of-concept exploit is currently listed for this CVE, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update CVE-2025-48805 advisory for vendor technical detail.

Detection Methods for CVE-2025-48805

Indicators of Compromise

Unexpected crashes or Windows Error Reporting entries referencing the Microsoft MPEG-2 Video Extension package or msmpeg2vdec components.
Unsigned or suspicious .mpg, .mpeg, .ts, or .m2ts files staged in user profile directories or temporary paths prior to media application launches.
Child processes spawned from media player or codec host processes that perform reconnaissance, credential access, or network activity.

Detection Strategies

Monitor for anomalous process behavior originating from applications that consume the MPEG-2 codec, particularly command interpreters or scripting engines launched as children.
Alert on heap corruption exceptions (0xC0000374, 0xC0000005) inside processes loading the MPEG-2 Video Extension libraries.
Correlate file write events for MPEG-2 media artifacts with subsequent execution of untrusted binaries in the same user session.

Monitoring Recommendations

Enable Windows Event Log forwarding for Application, WER, and Sysmon events tied to media playback and codec processes.
Track installed versions of the Microsoft MPEG-2 Video Extension from the Microsoft Store to confirm patched builds are deployed across the fleet.
Baseline normal MPEG-2 file handling activity so new spikes from unfamiliar sources can be identified quickly.

How to Mitigate CVE-2025-48805

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-48805 to all affected Windows client and server systems.
Update the Microsoft MPEG-2 Video Extension package through the Microsoft Store on every endpoint where the codec is installed.
Restrict handling of untrusted MPEG-2 media on systems where the update cannot be installed immediately.
Enforce least privilege so that users who process external media do not run with administrative rights.

Patch Information

Microsoft has published the fix through the Microsoft Security Response Center. The Microsoft Security Update CVE-2025-48805 advisory identifies the specific update packages for each supported Windows client and server version listed in the affected products section. Deploy the update through Windows Update, WSUS, Microsoft Intune, or the Microsoft Update Catalog according to the environment's standard patch process.

Workarounds

Remove the Microsoft MPEG-2 Video Extension from systems that do not require MPEG-2 playback until patching is complete.
Block delivery of MPEG-2 file types (.mpg, .mpeg, .ts, .m2ts) through email gateways and web proxies for user populations that do not need them.
Use AppLocker or Windows Defender Application Control to prevent execution of unapproved media applications that load the vulnerable codec.

bash

# Configuration example: enumerate and remove the MPEG-2 Video Extension via PowerShell
Get-AppxPackage -AllUsers -Name "Microsoft.MPEG2VideoExtension"
Get-AppxPackage -AllUsers -Name "Microsoft.MPEG2VideoExtension" | Remove-AppxPackage -AllUsers