CVE-2025-29963 · Windows Media Remote Code Execution Vulnerability

According to the CVSS metric, the attack vector is network (AV:N) and user interaction is required (UI:R). What is the target context of the remote code execution? This attack requires a user to open a specially crafted file from the attacker to initiate remote code execution.

How could an attacker exploit this vulnerability? An unauthenticated attacker who successfully exploited this vulnerability could gain code execution through convincing a user to open a malicious document at which point the attacker could execute arbitrary code in the context of the user.

Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code over a network.

Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.