Microsoft Web Media Extensions vulnerabilities

2 CVEs affecting Microsoft Web Media Extensions, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-81352, published 2026-09-08.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-28465, published 2021-05-11. High severity, CVSS 7.8. EPSS: 3.7% chance of exploitation in the next 30 days. Web Media Extensions Remote Code Execution Vulnerability
• CVE-2026-81352, published 2026-09-08. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.