CVE-2026-96150: Microsoft Windows Codecs Library Information Disclosure Vulnerability

CVE-2026-96150 is an information disclosure vulnerability in Microsoft Windows Codecs Library, rated Important by Microsoft, with a CVSS 3.1 base score of 5.6 (Medium). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.31% probability of exploitation activity in the next 30 days, higher than 24% of all scored vulnerabilities. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday, delivered through 10 security updates (KB5131291, KB5131085, KB5131096, KB5131090 and more). It affects 29 products in 3 product families (Microsoft Office, ESU, Windows).

Key facts

CVE ID: CVE-2026-96150
Severity: Medium CVSS 5.6
Microsoft severity: Important
Impact: Information Disclosure
Exploited in the wild: No
Publicly disclosed: No
Exploitation likelihood: Less Likely
Weakness: CWE-908
EPSS: 0.31% (percentile 24%)
CISA KEV: Not listed
Released: 10 November 2026
Last updated: 13 November 2026
Patch Tuesday: November 2026 Patch Tuesday
Product families: Microsoft Office, ESU, Windows

CVSS score and vector

Microsoft scores CVE-2026-96150 at 5.6 (temporal 4.9) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C

Metric	Value
Attack vector	Local
Attack complexity	High
Privileges required	Low
User interaction	None
Scope	Changed
Confidentiality impact	High
Integrity impact	None
Availability impact	None
Exploit code maturity	Unproven
Remediation level	Official fix
Report confidence	Confirmed

Description

Use of uninitialized resource in Microsoft Windows Codecs Library allows an authorized attacker to disclose information locally.

Frequently asked questions (Microsoft)

What type of information could be disclosed by this vulnerability?

An attacker running in a restricted app environment could view portions of private image data previously handled by the thumbnail service outside that environment. The vulnerability does not provide unrestricted access to arbitrary files or credentials.

According to the CVSS metric, attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation requires the thumbnail service to have processed private image data and later reuse related memory for the attacker's thumbnail request. The attacker cannot assume that this combination of prior activity and memory reuse will occur.

Affected products (29)

Microsoft Office

Product	Security update	Type	Fixed build	Restart
Microsoft Office for Android	Release Notes	Security Update	16.0.20625.20014

ESU

Product	Security update	Type	Fixed build	Restart
Windows 10 Version 1607 for 32-bit Systems	KB5131291	Security Update	10.0.14393.9688	Yes
Windows 10 Version 1607 for x64-based Systems	KB5131291	Security Update	10.0.14393.9688	Yes
Windows Server 2016	KB5131291	Security Update	10.0.14393.9688	Yes
Windows Server 2016 (Server Core installation)	KB5131291	Security Update	10.0.14393.9688	Yes
Windows 10 Version 22H2 for 32-bit Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for x64-based Systems

Windows

Product	Security update	Type	Fixed build	Restart
Windows 10 Version 1809 for 32-bit Systems	KB5131085	Security Update	10.0.17763.9487	Yes
Windows 10 Version 1809 for x64-based Systems	KB5131085	Security Update	10.0.17763.9487	Yes
Windows Server 2019	KB5131085	Security Update	10.0.17763.9487	Yes
Windows Server 2019 (Server Core installation)	KB5131085	Security Update	10.0.17763.9487	Yes
Windows 10 Version 21H2 for 32-bit Systems	KB5131096	Security Update	10.0.19044.7846	Yes
Windows 10 Version 21H2 for ARM64-based Systems	KB5131096	Security Update	10.0.19044.7846	Yes
Windows 10 Version 21H2 for x64-based Systems	KB5131096	Security Update	10.0.19044.7846	Yes
Windows Server 2022	KB5131090	Security Update	10.0.20348.5870	Yes
Windows Server 2022 (Server Core installation)	KB5131090	Security Update	10.0.20348.5870	Yes
Windows 11 Version 23H2 for ARM64-based Systems	KB5131087	Security Update	10.0.22631.7711	Yes
Windows 11 Version 23H2 for x64-based Systems	KB5131087	Security Update	10.0.22631.7711	Yes
Windows 11 Version 24H2 for ARM64-based Systems	KB5132061 KB5132043	Security Update Security Update	10.0.26100.9974 10.0.26100.9911	Yes No
Windows 11 Version 24H2 for x64-based Systems	KB5132061 KB5132043	Security Update Security Update	10.0.26100.9974 10.0.26100.9911	Yes No
Windows 11 Version 25H2 for ARM64-based Systems	KB5132043	Security Update	10.0.26200.9911	No
Windows 11 Version 25H2 for x64-based Systems	KB5132043	Security Update	10.0.26200.9911	No
Windows 11 Version 26H2 for ARM64-based Systems	KB5132043	Security Update	10.0.26300.9911	No
Windows 11 Version 26H2 for x64-based Systems	KB5132043	Security Update	10.0.26300.9911	No
Windows Server 2025	KB5131080 KB5131077	Security Update Security Hotpatch Update	10.0.26100.33822 10.0.26100.33730	Yes No
Windows Server 2025 (Server Core installation)	KB5131080 KB5131077	Security Update Security Hotpatch Update	10.0.26100.33822 10.0.26100.33730	Yes No
Windows 11 Version 26H1 for ARM64-based Systems	KB5132059	Security Update	10.0.28000.3501	Yes
Windows 11 version 26H1 for x64-based Systems	KB5132059	Security Update	10.0.28000.3501	Yes

Security updates (10)

KB5131291 (Security Update)
KB5131085 (Security Update)
KB5131096 (Security Update)
KB5131090 (Security Update)
KB5131087 (Security Update)
KB5132061 (Security Update)
KB5132043 (Security Update)
KB5131080 (Security Update)
KB5131077 (Security Hotpatch Update)
KB5132059 (Security Update)

NIST NVD data

NVD status: Undergoing Analysis
NVD CVSS: 5.6 (MEDIUM)
NVD weakness: CWE-908
Published to NVD: 10 November 2026
NVD last modified: 12 November 2026

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96150

Acknowledgments

Edson de Azevedo Martins
Yuri Borges

Revision history

Version	Date	Description
1.0	10 November 2026	Information published.
1.1	13 November 2026	Added Microsoft Office software to the Security Updates table. Customers that are running supported version of Microsoft Office are encouraged to update to the indicated version to be protected from this vulnerability.