Windows DirectMusic vulnerability rated critical with a score of 9.8

With its monthly security updates released on November 10, Microsoft fixed 1,439 vulnerabilities. Seventy of them are rated critical. The standout issues are in the DirectMusic and Media Foundation components: both contain flaws that let an attacker execute code over the network without needing any privileges.

Two separate 9.8-rated flaws in DirectMusic

CVE-2026-95882 in the DirectMusic component is a stack-based buffer overflow. The NVD rates this flaw as critical with a 9.8 score. CVE-2026-95901 in the same component is a double free bug, and it also scores 9.8. Both flaws allow an unauthenticated attacker to execute code over the network. Also in the same component are CVE-2026-95891 and CVE-2026-95896, which are limited to local exploitation and rated 7.8.

Microsoft’s own assessment is more cautious than the NVD’s: the company classifies these four flaws as “Important” and reports no active exploitation. Even so, the fact that they can be triggered by a network request makes any Windows machine that works with audio and music files a potential target.

Media and codec components were affected too

The same update also fixes CVE-2026-96157 in Media Foundation. This flaw, also a stack-based buffer overflow, is rated 9.8 and is exposed to remote code execution over the network. CVE-2026-122168, meanwhile, allows local privilege escalation in the same component.

On the Windows Codecs Library side, CVE-2026-113749 is a critical remote code execution flaw. The same library also received patches for an 8.8-rated integer underflow (CVE-2026-114164) and two more 7.8-rated overflow bugs (CVE-2026-114165, CVE-2026-114167). The fix for HEVC Video Extensions is being distributed through the Microsoft Store rather than Windows Update.

Affected versions and update path

The flaws affect Windows 10 versions from 1607 through 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2, as well as Windows Server 2025. For Windows 11 23H2, the fix is in package KB5131087; for 24H2, 25H2, and 26H2, it’s KB5132043. On the Windows Server 2025 side, KB5131077 and KB5131080 are the relevant packages.

You can get the update the usual way: just go to Windows Update from the Settings menu and click “Check for updates.” On corporate machines, distribution through WSUS or Intune may be delayed by a few days; in that case, it’s possible to download it manually from the Microsoft Update Catalog using the KB number. A restart is required after the update, because DirectMusic and Media Foundation are components loaded at the driver level.

This month’s only actively exploited flaw is in Outlook

In the November bulletin, the only flaw confirmed to be actively exploited is CVE-2026-124194 in Outlook. Microsoft fixed that one in the same wave as well. There is currently no published proof-of-concept for the DirectMusic and Media Foundation flaws; however, vulnerabilities in components like these tend to fall into the group that starts getting exploited before patches are widely deployed.

Source: Microsoft MSRC · NVD