Cyber Posture

CVE-2026-20837

High

Published: 13 January 2026

Published
13 January 2026
Modified
15 January 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0004 12.2th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-20837 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 12.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the heap-based buffer overflow by requiring timely flaw remediation through vendor patches for the Windows Media component.

prevent

Provides memory protections like DEP and ASLR that prevent arbitrary code execution from heap buffer overflow exploits even if unpatched.

prevent

Mandates validation of information inputs such as media files to block specially crafted inputs that trigger the buffer overflow.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Heap buffer overflow in Windows Media client app is directly triggered by user opening a crafted media file (T1204.002), enabling client-side code execution via exploitation (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.

Deeper analysisAI

CVE-2026-20837 is a heap-based buffer overflow vulnerability (CWE-122) in Windows Media. Published on January 13, 2026, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw allows an unauthorized attacker to execute arbitrary code locally on affected Windows systems running the Windows Media component.

An attacker with local access to the target system can exploit this vulnerability by tricking a user into performing an action that triggers the buffer overflow, such as opening a specially crafted media file. No special privileges are required (PR:N), and the attack complexity is low (AC:L), though user interaction is necessary (UI:R). Successful exploitation leads to high-impact consequences, including unauthorized access to sensitive data (C:H), modification of system files or behavior (I:H), and denial of service (A:H), all within the user's scope without privilege escalation (S:U).

Microsoft's Security Response Center (MSRC) update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20837 provides details on affected versions and recommended mitigations, including available patches.

Details

CWE(s)

Affected Products

microsoft
windows 10 1809
≤ 10.0.17763.8276 · ≤ 10.0.17763.8276
microsoft
windows 10 21h2
≤ 10.0.19044.6809
microsoft
windows 10 22h2
≤ 10.0.19045.6809
microsoft
windows 11 23h2
≤ 10.0.22631.6491
microsoft
windows 11 24h2
≤ 10.0.26100.7623
microsoft
windows 11 25h2
≤ 10.0.26200.7623
microsoft
windows server 2019
≤ 10.0.17763.8276
microsoft
windows server 2022
≤ 10.0.20348.4648
microsoft
windows server 2022 23h2
≤ 10.0.25398.2092
microsoft
windows server 2025
≤ 10.0.26100.32230

CVEs Like This One

CVE-2025-53131Same product: Microsoft Windows 10 1809
CVE-2026-20864Same product: Microsoft Windows 10 1809
CVE-2025-21305Same product: Microsoft Windows 10 1809
CVE-2025-21239Same product: Microsoft Windows 10 1809
CVE-2025-59295Same product: Microsoft Windows 10 1809
CVE-2025-21266Same product: Microsoft Windows 10 1809
CVE-2025-21407Same product: Microsoft Windows 10 1809
CVE-2025-21303Same product: Microsoft Windows 10 1809
CVE-2025-21339Same product: Microsoft Windows 10 1809
CVE-2025-21233Same product: Microsoft Windows 10 1809

References