Deserialization of untrusted data inside the Windows Media Foundation component can allow a local user to lift privileges. By crafting a malicious media file that the framework processes, the attacker can execute code with the rights of an administrative or system account. The flaw is categorized as a Deserialization of Untrusted Data (CWE‑502) and provides a local privilege escalation vector.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, all variants with Server Core where applicable.

The CVSS base score of 7.8 designates a high level of severity, while the EPSS of 2% reflects a relatively low exploitation probability. The flaw is not currently listed in CISA’s KEV catalog. Because the attacker must be authenticated locally to trigger the deserialization, the attack surface is confined to machines with user accounts. However, successful exploitation grants elevated privileges, potentially allowing system‑wide compromise. No publicly available exploit details are known, yet the existence of an update and the high score warrant proactive mitigation.