BLOG
At a glance
- CVE-2026-113749 is a remote code execution vulnerability in Microsoft Windows Codecs Library, rated Critical by Microsoft.
- The record lists Windows 11, Windows 10, Windows Server, and Microsoft Office for Android with corresponding update information.
- Microsoft reports no exploitation in the wild; CVSS 3.1 is 7.5.
- Install the KB matching the system version and check Server Core systems as well.
Microsoft Windows Codecs Library: Patch Remote Code Execution Vulnerability CVE-2026-113749
Microsoft rates CVE-2026-113749 in Windows Codecs Library Critical; it can enable remote code execution over a network when a user interacts. No exploitation in the wild is reported. Install the update matching each Windows or Windows Server version.
In this article
Microsoft published advisory CVE-2026-113749 for Microsoft Windows Codecs Library, which provides codec-processing components in Windows. The vulnerability could allow remote code execution over a network, but exploitation requires high complexity and user interaction. See Microsoft’s advisory to compare the details and updates.
Overview and technical details
The issue is described as a heap-based buffer overflow in Microsoft Windows Codecs Library. Microsoft rates it Critical; the CVSS 3.1 score in the record is 7.5, and is not a score inferred from the severity label.
| Field | Details |
|---|---|
| Product | Microsoft Windows Codecs Library |
| Vulnerability | CVE-2026-113749 |
| CWE | CWE-122: Heap-based Buffer Overflow; CWE-190: Integer Overflow or Wraparound |
| CVSS | CVSS 3.1: 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) |
| Microsoft rating | Critical |
| Disclosure and exploitation | Publicly Disclosed: No; Exploited in the Wild: No |
Affected systems
The record lists the versions and update information below. Some branches have two KB/build entries listed separately; compare against the correct operating system branch.
| Product/version | Listed KB and build |
|---|---|
| Windows 11 Version 26H2, ARM64 and x64 | KB5132061, Build 10.0.26300.9974; KB5132043, Build 10.0.26300.9911 |
| Windows 11 Version 25H2, ARM64 and x64 | KB5132061, Build 10.0.26200.9974; KB5132043, Build 10.0.26200.9911 |
| Windows Server 2025, including Server Core | KB5131080, Build 10.0.26100.33822; KB5131077, Build 10.0.26100.33730 |
| Windows 11 version 26H1, x64 and ARM64 | KB5132059, Build 10.0.28000.3501 |
| Windows 11 Version 23H2, x64 and ARM64 | KB5131087, Build 10.0.22631.7711 |
| Windows 11 Version 24H2, ARM64 and x64 | KB5132061, Build 10.0.26100.9974; KB5132043, Build 10.0.26100.9911 |
| Windows Server 2022, including Server Core | KB5131090, Build 10.0.20348.5870 |
| Windows 10 Version 22H2, ARM64, x64, and 32-bit | KB5131096, Build 10.0.19045.7846 |
| Windows 10 Version 21H2, x64, ARM64, and 32-bit | KB5131096, Build 10.0.19044.7846 |
| Windows Server 2019, including Server Core; Windows 10 Version 1809, x64 and 32-bit | KB5131085, Build 10.0.17763.9487 |
| Windows Server 2016, including Server Core; Windows 10 Version 1607, x64 and 32-bit | KB5131291, Build 10.0.14393.9688 |
| Microsoft Office for Android | KBRelease Notes, Build 16.0.20625.20014 |
Mechanism and impact
The heap-based buffer overflow could allow an unauthenticated attacker to execute code over a network. Exploitation requires high complexity and user interaction; success is not guaranteed and also depends on the environment, system configuration, and additional security measures.
Exploitation status
Microsoft reports Exploited in the Wild: No and Publicly Disclosed: No. These are the statuses in the record; they do not change the need to install the applicable update.
System checks
List installed hotfixes to compare against the applicable KB:
Get-HotFix | Sort-Object InstalledOn -DescendingReview operating system information, then compare the version/build and KB with the corresponding branch in the affected systems table:
systeminfo
If the system does not have the corresponding update, it needs to be patched according to the guidance for its version.
Remediation and mitigation
Install the KB or update listed for the Windows or Windows Server version in use. Prioritize addressing and checking Server Core systems as well.
For Microsoft Office for Android, refer to KBRelease Notes, Build 16.0.20625.20014.
After installation, check the installed KB and operating system build using the checks above, then compare them with the corresponding information in the table.
Related articles
CVE-2026-95948: Update Windows to address a Windows Graphics Kernel privilege-escalation flaw
Microsoft disclosed CVE-2026-95948, a stack-based buffer overflow in the Windows Graphics Kernel that could let an authenticated local attacker escalate privileges to SYSTEM. Microsoft lists CVSS 7.8; it is not publicly disclosed or exploited in the wild. Install the KB matching the affected…
CVE-2026-95932: Update Windows to fix a privilege-escalation flaw to SYSTEM
Microsoft disclosed CVE-2026-95932, a privilege-escalation flaw in Windows Graphics Kernel, rated Important with CVSS 3.1 score 7.8. A local attacker could elevate privileges to SYSTEM. Microsoft reports no exploitation in the wild; install the matching fixed KB or build.
CVE-2026-88217: Update Windows and Office to fix an information disclosure flaw
Microsoft disclosed CVE-2026-88217, an information disclosure flaw in Windows Graphics Kernel affecting certain Windows, Windows Server, and Microsoft Office versions. Local access is required, and no in-the-wild exploitation is reported. Install the applicable KB or build.
Microsoft Windows Codecs Library: Patch information disclosure flaw CVE-2026-96150
Microsoft identifies CVE-2026-96150 as an information disclosure flaw in Windows Codecs Library, affecting listed Windows versions and Microsoft Office for Android. Check the applicable KB and install the corresponding update; exploitation in the wild has not been reported.