CVE-2026-70343
High CVSS 8.8Published 2026-10-13 ยท last changed 2026-10-13
From our blog
The fix
Microsoft fixes this in a Microsoft Store app update, so Windows Update and WSUS won't deliver it. The app at the version below, or later, has the fix.
| App | Fixed in version | Package | Released |
|---|---|---|---|
| MPEG-2 Video Extension | 1.2.32.0 | Microsoft.MPEG2VideoExtension | 2026-11-07 |
The Store updates these apps on its own schedule. A machine with Store updates turned off, or no
Store access at all (common on managed fleets), keeps the old version.
To check one, run Get-AppxPackage -AllUsers -Name Microsoft.MPEG2VideoExtension and
compare its Version to the table.
What it is
Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network.
Sources
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H