CVE-2026-108400: Microsoft Hevc Video Extensions

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.

Affected products

• Microsoft Hevc Video Extensions: from 1.0.0, before 2.4.87.0 (fixed in 2.4.87.0)
• Microsoft Hevc Video Extensions For Licensed Applications: from 2.0.0.0, before 2.4.85.0 (fixed in 2.4.85.0)
• Microsoft Hevc Video Extensions From Device Manufacturer: from 2.0.0.0, before 2.5.25.0 (fixed in 2.5.25.0)

Published 2026-10-13. Last modified 2026-10-13.