CVE-2026-72960: Windows Media Player Buffer Overflow

CVE-2026-72960 Overview

CVE-2026-72960 is a heap-based buffer overflow [CWE-122] in Windows Media Player. An unauthorized attacker can execute code over a network when a user opens a crafted media file or stream. The flaw affects confidentiality, integrity, and availability, and requires user interaction to trigger.

Microsoft published the advisory in the Microsoft Security Update Guide. No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Successful exploitation grants an unauthenticated remote attacker arbitrary code execution in the context of the user opening the media file, enabling full compromise of the affected host.

Affected Products

Microsoft Windows Media Player (see the Microsoft Security Update Guide for the enumerated build list)
Windows client editions shipping the vulnerable Media Player component
Windows Server editions where the Media Player feature is installed

Discovery Timeline

2026-09-08 - CVE-2026-72960 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72960

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow inside Windows Media Player. Media parsing routines write attacker-controlled data past the bounds of a heap allocation while processing a malformed media container or stream. Corrupting adjacent heap metadata or object pointers gives an attacker control of execution flow inside the player process.

Because Windows Media Player runs in the security context of the invoking user, code executed through this flaw inherits that user's privileges. On workstations where users hold local administrator rights, that context is sufficient to install persistence, disable defenses, or pivot laterally.

Root Cause

Heap-based buffer overflows in media players typically stem from missing or incorrect length validation when parsing container headers, codec parameters, or embedded metadata. The parser trusts a size field supplied by the file and copies more data than the destination heap buffer can hold. Microsoft has not published parser-level details beyond the classification of [CWE-122].

Attack Vector

Exploitation is network-reachable but requires user interaction. An attacker delivers a weaponized media file through email, a web download, a chat attachment, or a link to a streaming endpoint. When the user opens the file in Windows Media Player, the vulnerable parser processes the crafted structure and triggers the overflow.

No authentication or prior foothold is required. The EPSS model estimates a 0.752% probability of exploitation in the next 30 days (52.9th percentile), reflecting moderate near-term interest.

No verified public proof-of-concept exists at the time of writing. See the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-72960

Indicators of Compromise

Unexpected child processes spawned by wmplayer.exe or setup_wm.exe, particularly cmd.exe, powershell.exe, rundll32.exe, or regsvr32.exe.
Windows Media Player crashes with heap corruption exceptions (0xC0000374, STATUS_HEAP_CORRUPTION) in the Application event log.
Inbound media files with malformed container headers arriving via email, web, or file-share vectors immediately preceding process anomalies.
Outbound network connections initiated by wmplayer.exe to non-media infrastructure shortly after a file is opened.

Detection Strategies

Hunt for parent-child process chains where Windows Media Player launches script interpreters, LOLBins, or unsigned binaries.
Alert on module loads from user-writable directories (for example, %TEMP%, %APPDATA%) into the wmplayer.exe process.
Correlate WER (Windows Error Reporting) crash telemetry for wmplayer.exe with subsequent suspicious process activity on the same host.

Monitoring Recommendations

Ingest Sysmon Event IDs 1, 7, 10, and 11 from endpoints where Windows Media Player is present, and retain the telemetry for retrospective hunting.
Monitor perimeter and mail gateways for media MIME types (video/*, audio/*) delivered from untrusted senders and quarantine unknown senders' attachments.
Track Windows Update installation state for the security patch tied to CVE-2026-72960 across the fleet.

How to Mitigate CVE-2026-72960

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all Windows systems running Windows Media Player.
Prioritize patching for user workstations, VDI images, and jump hosts where users routinely open external files.
Block or strip inbound media attachments from untrusted senders at the mail gateway until patching is complete.
Advise users to avoid opening unsolicited audio and video files, including files delivered through collaboration tools.

Patch Information

Microsoft has released a security update addressing CVE-2026-72960. The authoritative source for affected builds, KB numbers, and download links is the Microsoft Security Update Guide. Deploy via Windows Update, WSUS, Microsoft Intune, or Configuration Manager per your standard change process.

Workarounds

Remove the Windows Media Player optional feature on systems that do not require it using Disable-WindowsOptionalFeature or the Optional Features UI.
Change the default file association for common media extensions (.wmv, .wma, .asf, .mp3, .mp4) to a hardened, patched alternative until the update is deployed.
Enforce Attack Surface Reduction (ASR) rules that block Office and script interpreters from being spawned as child processes, limiting post-exploitation options.
Apply application control policies (WDAC or AppLocker) to prevent execution of unsigned binaries from user-writable paths.

bash

# Configuration example: remove Windows Media Player feature (PowerShell, elevated)
Disable-WindowsOptionalFeature -Online -FeatureName "WindowsMediaPlayer" -NoRestart

# Verify feature state after reboot
Get-WindowsOptionalFeature -Online -FeatureName "WindowsMediaPlayer"