EIP-2026-117571

PRE-CVE

Microsoft Windows Media Center WMV / WMA 6.3.9600.16384 - Code Execution

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-117571. PoCs published by Eduardo Braun Prado.

AI-analyzed exploit summary This exploit leverages a security bypass in Microsoft Windows Media Center (WMV/WMA file parsing) to achieve arbitrary code execution by embedding a 'URL' script instruction in a crafted file. It exploits the lack of 'Local Machine Zone Lockdown' in the ehexthost32 plugin, allowing navigation to local files and execution in a privileged context.

Description

Microsoft Windows Media Center WMV / WMA 6.3.9600.16384 - Code Execution

Exploits (1)

exploitdb WORKING POC
by Eduardo Braun Prado · textlocalwindows
https://www.exploit-db.com/exploits/47981

This exploit leverages a security bypass in Microsoft Windows Media Center (WMV/WMA file parsing) to achieve arbitrary code execution by embedding a 'URL' script instruction in a crafted file. It exploits the lack of 'Local Machine Zone Lockdown' in the ehexthost32 plugin, allowing navigation to local files and execution in a privileged context.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Windows Media Center 6.3.9600.16384
No auth needed
Prerequisites: Ability to deliver a crafted WMV/WMA file to the target · User interaction to open the file in Windows Media Center
devstral-2 · analyzed Feb 19, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026