Loading vulnerability…
Remote Code Execution in Windows Microsoft DirectMusic
CVE-2026-95901 is a double-free vulnerability in Windows Microsoft DirectMusic that allows an unauthenticated attacker to execute arbitrary code over a network. An in-network attacker can trigger exploitation by calling arbitrary endpoints, without prior privileges or user interaction. The specific vulnerable function and affected Windows versions are not identified. Microsoft assigns a CVSS v3.1 base score of 9.8 and an Important severity rating, with exploitation assessed as less likely. No exploitation or public disclosure was reported at original publication.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality, integrity, and availability of the affected system through remote arbitrary code execution. The CVSS assessment assigns high impact across all three dimensions, with unchanged scope. The execution security context is not specified.
If you can’t patch tonight, do this now.
No vulnerability-specific interim mitigation or workaround is identified. Consult Microsoft's vulnerability advisory for any updated workaround guidance.
Patch, then assume compromise.
Apply Microsoft's official security update for CVE-2026-95901. Consult the Microsoft Security Response Center Security Update Guide to identify the applicable update for the installed Windows release and architecture. Specific KB identifiers and fixed build numbers are not available.
No public exploits tracked yet. Mallory keeps watching.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.