CVE-2026-58599: Microsoft HEVC Video Extensions Heap Buffer Overflow Remote Code Execution

HERMES

HERMES THREAT SCORE & MULTIMEDIA CODEC EXPLOITATION

Target: Microsoft HEVC Video Extensions (hevcdecoder.dll / mfds.dll)

Confidence: 95%

88 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 16 / 20

Weaponization 17 / 20

Exposure 18 / 20

Prevalence 20 / 20

Impact 19 / 20

Exploit Maturity 17 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-58599 at 7.8 (HIGH, CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The Hermes Threat Score assigns 88 (HIGH) reflecting universal deployment of H.265/HEVC decoders across enterprise endpoints and the ease of delivering weaponized video media via web, email, or collaboration tools.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-58599: Microsoft HEVC Video Extensions Heap Buffer Overflow Remote Code ExecutionVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Windows & Windows Server

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Windows & Windows Server documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

1. Technical Context & Affected Software Matrix

The Microsoft HEVC Video Extension package enables Windows applications (such as Windows Media Player, Movies & TV, Photos, Edge, and third-party software using Media Foundation) to play and process H.265 4K and Ultra HD video streams.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	`CVE-2026-58599`	MSRC Bulletin September 2026
Vulnerable Component	`Microsoft Windows Codecs Library (hevcdecoder.dll / mfds.dll)`	H.265 / HEVC Media Foundation Transform (MFT)
CWE Weakness	`CWE-122: Heap-based Buffer Overflow`	Incorrect boundary calculation in tile slice reconstruction
CVSS v3.1 Score	7.8 (HIGH / Hermes Operational Severity 88)	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
Attack Vector	Local file playback / Web video streaming	Requires victim to open or preview crafted media
Affected Packages	Microsoft.HEVCVideoExtension, Microsoft.HEVCVideoExtensionsFromDeviceManufacturer	Deployed across Windows 10, Windows 11
Remediation Method	Microsoft Store automatic update / Package `2.1.20261.0`	Automatic store update delivery

2. In-Depth Technical Decomposition & Root Cause

The HEVC standard (ITU-T H.265) structures video bitstreams into Network Abstraction Layer (NAL) units, including Sequence Parameter Sets (SPS), Picture Parameter Sets (PPS), and slice segments. Slices can be divided into independent or dependent tiles to facilitate multi-threaded decoding.

In hevcdecoder.dll, the routine responsible for parsing tile slice headers (ParseTileSliceSegmentHeader) evaluates the tile_column_width_minus1 and tile_row_height_minus1 parameters declared in the PPS:

// Conceptual depiction of CVE-2026-58599 NAL parser vulnerability
int HevcDecoder::ParseTileSliceHeader(
    PHEVC_BITSTREAM pStream,
    PHEVC_PICTURE_CONTEXT pPicCtx
) {
    int num_tile_columns = pPicCtx->pps.num_tile_columns_minus1 + 1;
    int num_tile_rows = pPicCtx->pps.num_tile_rows_minus1 + 1;

    // VULNERABILITY: Integer calculation does not validate that
    // num_tile_columns * num_tile_rows matches the allocated tile state table
    int total_tiles = num_tile_columns * num_tile_rows;
    if (pStream->dependent_slice_segment_flag) {
        // Decoder inherits previous slice position without re-verifying tile boundaries
        int tile_idx = pPicCtx->current_tile_idx;

        // Out-of-bounds heap write during motion vector prediction cache update
        pPicCtx->tile_state_table[tile_idx].motion_vector_ref = pStream->read_bits(8);
    }
    return 0;
}

When a malformed bitstream sets dependent_slice_segment_flag=1 while declaring inconsistent tile dimensions between SPS and PPS, the decoder uses a stale tile_idx that indexes beyond the bounds of tile_state_table, writing controlled motion vector parameters directly into adjacent heap chunks.

3. Attack Vectors & Enterprise Threat Scenarios

[ Attacker crafts weaponized .MP4 / .MKV video file ]
               │
               ▼ (Deliver via Phishing, Slack, Teams, or Malicious Webpage)
[ Victim opens or previews video clip ]
               │
               ▼ (Windows Media Foundation loads hevcdecoder.dll)
[ Trigger CVE-2026-58599 Heap Buffer Overflow ]
               │
               ▼ (Execute Shellcode inside media player process)
[ Harvest Local Credentials / Deploy Persistent C2 Agent ]
               │
               ▼
[ Escalate Privileges & Pivot to Active Directory Infrastructure ]

Forensic Correlation with Hermes Codex

Access Tokens and Security Context: The initial exploit payload executes with the privileges of the active interactive user token. See AD-06: Windows access tokens and security context.
Administrative Boundaries & Containment: Initial compromise of client workstations is the primary starting point for lateral movement toward domain controllers. See AD-10: Administrative boundaries in Windows and Active Directory.
Forensic Triage of Compromised Accounts: Investigating the origins and rights of the hijacked identity. See AD-32: DFIR triage: account existence, origin and rights.

4. Forensic Detection, Artefacts & Event IDs

Forensic analysis of CVE-2026-58599 exploitation involves examining media player crash events and web browser download histories:

Essential Artefacts & Event IDs

Application Error Event ID 1000: Crash of wmplayer.exe, PhotosApp.exe, Microsoft.Media.Player.exe, or browser processes citing faulting module hevcdecoder.dll and exception code 0xc0000005 or 0xc0000374.
Mark-of-the-Web (Zone.Identifier): Verifying if the suspicious video file contains ZoneId=3 indicating internet download origin.
Sysmon Event ID 1 (Process Creation): Media player applications spawning unauthorized child processes (cmd.exe, powershell.exe, rundll32.exe).

Splunk / KQL Detection Query

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("wmplayer.exe", "Microsoft.Media.Player.exe", "PhotosApp.exe", "Video.UI.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "rundll32.exe", "certutil.exe", "wscript.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc

5. Remediation, Hardening & Defensive Engineering

Verify HEVC Video Extension Version: Ensure installed packages are updated to version 2.1.20261.0 or higher:
Terminal window
```
Get-AppxPackage -Name Microsoft.HEVCVideoExtension* | Select-Object Name, Version
```
Enable Exploit Protection / Windows Defender Exploit Guard: Ensure Arbitrary Code Guard (ACG) and Control Flow Guard (CFG) are enabled for media playback binaries.
Endpoint Detection and Response (EDR): Configure behavioral alerting for abnormal process spawns from media player applications.