Windows Media Photo Codec Information Disclosure Vulnerability
Priority LOW 26CWE-908Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.
Summary
Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00541 45th percentileScored 2026-11-07
Fix Fixed Microsoft Office 365 for Mac (Microsoft): 16.112.26090911Microsoft Office for Android (Microsoft): 16.0.20430.20000+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft Office 365 for Mac | 1.0.0 to before 16.112.26090911 | 16.112.26090911 | Patch available | CNA |
| Microsoft | Microsoft Office for Android | 16.0.1 to before 16.0.20430.20000 | 16.0.20430.20000 | Patch available | CNA |
| Microsoft | Microsoft Office LTSC for Mac 2021 | 16.0.1 to before 16.112.26090911 | 16.112.26090911 | Patch available | CNA |
| Microsoft | Microsoft Office LTSC for Mac 2024 | 16.0.0 to before 16.112.26090911 | 16.112.26090911 | Patch available | CNA |
- Microsoft Office 365 for Mac VendorMicrosoft Affected 1.0.0 to before 16.112.26090911 Fixed in 16.112.26090911 Patch available CNA
- Microsoft Office for Android VendorMicrosoft Affected 16.0.1 to before 16.0.20430.20000 Fixed in 16.0.20430.20000 Patch available CNA
- Microsoft Office LTSC for Mac 2021 VendorMicrosoft Affected 16.0.1 to before 16.112.26090911 Fixed in 16.112.26090911 Patch available CNA
- Microsoft Office LTSC for Mac 2024 VendorMicrosoft Affected 16.0.0 to before 16.112.26090911 Fixed in 16.112.26090911 Patch available CNA
CPE configurations NVD · 22
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* | before 10.0.14393.9339 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* | before 10.0.14393.9339 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* | before 10.0.17763.9020 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* | before 10.0.17763.9020 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:* | before 10.0.19044.7548 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:* | before 10.0.19044.7548 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:* | before 10.0.19044.7548 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:* | before 10.0.19045.7548 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:* | before 10.0.19045.7548 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:* | before 10.0.19045.7548 | Vulnerable | Microsoft |
- cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* Versions before 10.0.14393.9339 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* Versions before 10.0.14393.9339 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* Versions before 10.0.17763.9020 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* Versions before 10.0.17763.9020 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:* Versions before 10.0.19044.7548 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:* Versions before 10.0.19044.7548 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:* Versions before 10.0.19044.7548 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:* Versions before 10.0.19045.7548 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:* Versions before 10.0.19045.7548 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:* Versions before 10.0.19045.7548 Vulnerable ·Microsoft
Show 12 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:* | before 10.0.26100.8875 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* | before 10.0.26100.8875 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:* | before 10.0.26200.8875 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:* | before 10.0.26200.8875 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:* | before 10.0.28000.2269 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:* | before 10.0.28000.2269 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* | r2 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:-:*:x64:* | before 10.0.14393.9339 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:-:*:x64:* | before 10.0.17763.9020 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:x64:* | before 10.0.20348.5386 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:* | before 10.0.26100.33158 | Vulnerable | Microsoft |
- cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:* Versions before 10.0.26100.8875 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* Versions before 10.0.26100.8875 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:* Versions before 10.0.26200.8875 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:* Versions before 10.0.26200.8875 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:* Versions before 10.0.28000.2269 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:* Versions before 10.0.28000.2269 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:-:*:x64:* Versions before 10.0.14393.9339 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:-:*:x64:* Versions before 10.0.17763.9020 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:x64:* Versions before 10.0.20348.5386 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:* Versions before 10.0.26100.33158 Vulnerable ·Microsoft
Remediation
- Fix · CNA Microsoft Office 365 for Mac (Microsoft) Fixed in 16.112.26090911
- Fix · CNA Microsoft Office for Android (Microsoft) Fixed in 16.0.20430.20000
- Fix · CNA Microsoft Office LTSC for Mac 2021 (Microsoft) Fixed in 16.112.26090911
- Fix · CNA Microsoft Office LTSC for Mac 2024 (Microsoft) Fixed in 16.112.26090911
Vendor assessments
Microsoft
Microsoft's page for this CVE →
- Impact
- Information Disclosure
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Unlikely
| Product | Status | Plan or fix |
|---|---|---|
| Microsoft Office 365 for Mac | Fixed | 16.112.26090911 · Security Update |
| Microsoft Office LTSC for Mac 2021 | Fixed | 16.112.26090911 · Security Update |
| Microsoft Office LTSC for Mac 2024 | Fixed | 16.112.26090911 · Security Update |
| Microsoft Office for Android | Fixed | 16.0.20430.20000 · Security Update |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-57083
- 2026-10-03 Alias added: GHSA-fqm2-mxm5-2mqm
- 2026-10-28 Fix available: Microsoft/Microsoft Office 365 for [email protected], Microsoft/Microsoft Office LTSC for Mac [email protected], Microsoft/Microsoft Office LTSC for Mac [email protected] +1 · CNA
References
More Microsoft Windows 10 1607 vulnerabilities
- TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2017-06077 Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-73128 Windows Shell Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 8.8
- TI-2026-17367 MSHTML Framework Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 8.8
- TI-2026-17364 Windows Shell Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 8.8
- TI-2025-24062 Windows SMB Client Elevation of Privilege Vulnerability KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2026-57083 · CVE Program
- CVE-2026-57083 · NVD
- FIRST EPSS
- GHSA-fqm2-mxm5-2mqm · GitHub Advisory Database · CC BY 4.0
- CVE-2026-57083 · Microsoft Security Update Guide
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences