CVE-2026-58599: Microsoft Hevc Video Extensions

High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.

Affected products

• Microsoft Hevc Video Extensions: before 2.4.87.0 (fixed in 2.4.87.0)
• Microsoft Hevc Video Extensions For Licensed Applications: before 2.4.85.0 (fixed in 2.4.85.0)
• Microsoft Hevc Video Extensions From Device Manufacturer: before 2.4.86.0 (fixed in 2.4.86.0); before 2.5.25.0 (fixed in 2.5.25.0)

Published 2026-09-08. Last modified 2026-10-01.