Loading story…
Microsoft patched two high-severity vulnerabilities in the Windows DirectMusic component after STAR Labs disclosed memory-corruption flaws in dmusic.dll tied to parsing specially crafted DLS files. The issues, tracked as CVE-2022-44667 and CVE-2022-44668, affect the IDirectMusicPort COM functionality used by DirectX for MIDI and downloadable sound handling, and both bugs could lead to code execution if a victim processes malicious content.
CVE-2022-44667 is an integer-overflow bug in articulation data handling that can cause an out-of-bounds write because size calculations and buffer allocation become inconsistent before unsafe memory copying occurs. CVE-2022-44668 involves an integer overflow that can trigger a heap double free during DLS parsing, with multiple code paths releasing the same buffer without verifying whether it was already freed. STAR Labs researcher Lê Hữu Quang Linh reported both flaws to Microsoft, which issued fixes for the vulnerabilities as part of its December 13, 2022 security updates.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft released fixes for CVE-2022-44667 and CVE-2022-44668, two high-severity vulnerabilities in the DirectMusic Core Services DLL (dmusic.dll). The patched issues included an integer overflow leading to out-of-bounds write and a double-free condition that could enable remote code execution.
STAR Labs researcher Lê Hữu Quang Linh disclosed CVE-2022-44667 and CVE-2022-44668 to Microsoft. Both flaws affected the DirectMusic component in Windows and involved memory corruption issues triggered by crafted DLS data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security updates for a cluster of **Windows Digital Media** and **Windows Media** elevation-of-privilege vulnerabilities, including `CVE-2025-21226`, `CVE-2025-21228`, `CVE-2025-21229`, `CVE-2025-21255`, `CVE-2025-21256`, `CVE-2025-21260`, `CVE-2025-21265`, `CVE-2025-21324`, `CVE-2025-21327`, and `CVE-2025-32716`. The issues were listed in Microsoft’s Security Update Guide as local privilege escalation bugs affecting Windows media-related components. The bulk of the advisories identify **Windows Digital Media Elevation of Privilege Vulnerability** entries, while `CVE-2025-32716` is tracked as a **Windows Media Elevation of Privilege Vulnerability**, indicating a broader set of media-handling components were affected. Microsoft provided update-guide entries for each CVE, signaling that organizations should prioritize applying the relevant Windows security updates to reduce the risk of attackers gaining elevated privileges on vulnerable systems.
Jul 12, 2026
Microsoft published security advisories for several **Windows information disclosure vulnerabilities** affecting components including the **COM Server**, **DWM Core Library**, **Windows Management Services**, **Windows Imaging Component**, and **DHCP Server Service**. The issues were tracked as `CVE-2026-20806`, `CVE-2025-33052`, `CVE-2025-59204`, `CVE-2025-53799`, `CVE-2025-21272`, and `CVE-2023-36012`, showing a broad spread of disclosure risks across both client and server-side Windows functionality. Among the disclosed flaws, Microsoft provided the most detail for `CVE-2026-20806`, describing it as a **type confusion** bug in the Windows COM Server that could let a local attacker with **low privileges** read sensitive data, including potentially **User Mode Service Memory**, without user interaction. Microsoft rated that issue **Important** with a **CVSS 3.1 score of 5.5**, said exploitation was considered unlikely, reported no public disclosure or observed exploitation at publication, and stated that an official fix was available; the remaining advisories were listed as information disclosure vulnerabilities with limited public technical detail.
Jun 29, 2026
Microsoft released fixes for 61 vulnerabilities in its May security updates, including three zero-days and one critical flaw, with **CVE-2024-30040** and **CVE-2024-30051** confirmed as actively exploited in the wild. The patched issues affect core Microsoft products including Windows, Office, SharePoint, .NET, Visual Studio, and Windows Server, and include a **Windows MSHTML Platform security feature bypass** and a **Windows DWM Core Library elevation-of-privilege flaw** that can allow attackers to gain `SYSTEM` privileges. Researchers who reported **CVE-2024-30051** said they validated the Windows Desktop Window Manager flaw after finding a suspicious document uploaded to VirusTotal, then later observed an exploit in mid-April being used with **QakBot** and other malware. Kaspersky assessed that multiple threat actors likely had access to the exploit before the patch was released, underscoring the urgency for organizations to deploy Microsoft's updates immediately across affected Windows and server environments.
Jul 24, 2026