According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution? The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer. What is the difference between HEVC Video Extension and HEVC Video Extensions? HEVC Video Extension is available to consumers and HEVC Video Extensions is used by device OEMs. How can I check if the update is installed? If your device manufacturer preinstalled this app, package versions 2.0.51121.0 and later contain this update. If you purchased this app from the Microsoft Store, package versions 2.0.51122.0 and later contain this update. You can check the package version in PowerShell: Get-AppxPackage -Name Microsoft.HEVCVideoExtension* Is Windows vulnerable in the default configuration? No. Only customers who have installed the optional HEVC or "HEVC from Device Manufacturer" media codecs from Microsoft Store may be vulnerable. How do I get the updated Windows Media Codec? Affected customers will be automatically updated by Microsoft Store. Customers do not need to take any action to receive the update. Alternatively, customers who want to receive the update immediately can check for updates with the Microsoft Store App; more information on this process can be found here. Why are these security updates offered to affected clients via the Microsoft Store and not Windows Update? These updates are for optional apps/components that are offered to customers as a download via the Microsoft Store. Updates for optional store apps/com
Dhanesh Kizhakkinan with Mandiant, PeaceMaker