CVE-2026-96186 HIGH

CVE-2026-96186: Microsoft Windows Media Foundation Elevation of Privilege Vulnerability

Vendor Microsoft
Product Windows 10 Version 1607
Weakness CWE-502 · Unsafe deserialization
Published October 13, 2026
Last update October 19, 2026
View on NVD All CVEs

CVSS base score

7.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

What the vulnerability does

01Description

Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

Key dates

02Disclosure timeline

October 13, 2026 CVE published
October 19, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-57724 WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability CVE-2026-57677 WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability CVE-2026-65573 WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability CVE-2026-66650 WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability CVE-2026-65572 WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability