# CVE-2026-48574 — Windows Media `mfmkvsrcsnk.dll` HEVC Parameter-Set Table Overflow: Store-Before-Bounds-Check in `MkvMfStreamVideoHEVC::GetMFMediaType`

---

## Summary

| | |
|---|---|
| **Product** | Windows — `mfmkvsrcsnk.dll` (Media Foundation Matroska/MKV source; HEVC track) |
| **CVE ID** | CVE-2026-48574 |
| **Impact** | Remote Code Execution |
| **MSRC severity** | **Critical** |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-122: Heap-based Buffer Overflow (off-by-one store-before-check) |
| **Delivery** | A crafted MKV/HEVC media file opened/played by the user (`UI:R`) |
| **KB / Fixed build** | KB5094126 — `mfmkvsrcsnk.dll` 10.0.26100.8655 (Win11 24H2 x64) |
| **Patch Date** | June 9, 2026 (2026-Jun) |
| **Pre-patch binary** | `mfmkvsrcsnk.dll` 10.0.26100.8328 — SHA256 `83a8fe556cc10566099510172cbf4cfea0c28cb4671f771c3519b4c247973a60` |
| **Post-patch binary** | `mfmkvsrcsnk.dll` 10.0.26100.8655 — SHA256 `8a610beeeb0d5469c6923dc6131d40a2e16d66fc97ddaf477f7869408026e5fe` |
| **Feature flag** | None — the fix is an unconditional reorder |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`mfmkvsrcsnk.dll` is the Media Foundation Matroska (MKV) source/sink. For an HEVC
track, `MkvMfStreamVideoHEVC::GetMFMediaType` parses the track's `CodecPrivate`
(the `hvcC` structure) — a set of parameter-set NAL units — and records each NAL's
length in a **length table at `this + 0x1E0`**. That table is **`0x800` bytes**, so
on a DWORD basis it holds **512 entries** (valid index 0–511).

---

## Vulnerability Summary

While parsing HEVC `CodecPrivate`, the parser **wrote the length into the table
before checking the index bound**:

```c
// GetMFMediaType (10.0.26100.8328) — PRE-PATCH, from our diff
*(uint *)(*(longlong *)(this + 0x1e0) + v3 * 4) = nalUnitLength + 4;  // *** store FIRST ***
v3++;
if (0x200 < v3) { MFMediaType = -1072875842; }                       // *** bound check AFTER ***
```

When the store index reaches **512** (already out of range), the code executes
`table[512] = nalUnitLength + 4` — a **4-byte write immediately past** the
`0x800`-byte table — *before* the `v3 > 0x200` check increments and stops parsing.
The check exists but runs one iteration too late.

The written value is `nalUnitLength + 4` in big-endian, attacker-influenced
(range 4..0x10003). Because the parser checks the NAL type only **once per array**
(not per NAL), a single parameter-set array with `numNalus = 513` yields 513 store
targets, and ~1 KB of `CodecPrivate` is enough to drive the index to 512 — a
controllable **4-byte heap overflow** right behind the table (CWE-122). As HEVC
media is processed by Media Foundation on simply opening a file, this is a
Critical RCE (`UI:R`).

---

## Prerequisites and Constraints

- The victim opens / plays a crafted MKV file with an HEVC track (`UI:R`, `PR:N`).
- `CodecPrivate` declares a parameter-set array with `numNalus` ≥ 513 so the length
  table index reaches 512.
- Result: a 4-byte, partially attacker-controlled write just past the `0x800`-byte
  heap table.

---

## Vulnerability Details

### Root Cause

The bounds check on the parameter-set length-table index was performed **after**
the write, so the first out-of-range index (512) still executed one 4-byte store
past the end of the fixed `0x800`-byte table.

### The patch (confirmed — diff, .8328 → .8655)

The fix simply **reverses the order**: the index is bounds-checked (and the store
guarded by `index < 0x200`) *before* writing:

```c
// GetMFMediaType (10.0.26100.8655) — PATCHED, from our diff
if (0x200 < uVar10) { /* ...fail path... */ }        // bound checked up front
...
if ((uint)uVar15 < 0x200)                            // *** guard the store ***
    *(uint *)(*(longlong *)(this + 0x1e0) + uVar15 * 4) = uVar10 + 4;
```

With the store now conditioned on `index < 0x200` (512) and the failure detected
before writing, the out-of-bounds `table[512]` write no longer occurs. Our diff of
`mfmkvsrcsnk.dll` 10.0.26100.8328 → .8655 shows the pre-patch unconditional store
(`table[idx*4] = len+4`) followed by a late `0x200 < idx` check replaced with the
bound check + `idx < 0x200`-guarded store. Unconditional fix (no feature flag).

### Patch Completeness Assessment

The reorder removes the single off-by-one write; the table remains 512 entries and
oversized `numNalus` now fails cleanly.

---

## Detection Guidance

**Behavioural.** MKV/HEVC files whose `hvcC` `CodecPrivate` declares an abnormally
large parameter-set count (`numNalus` ≥ 513); heap-corruption crashes in
`mfmkvsrcsnk!MkvMfStreamVideoHEVC::GetMFMediaType` while resolving the media type
on unpatched builds.

---

## References

- MSRC advisory — CVE-2026-48574 (Windows Media Remote Code Execution), released 2026-06-09, KB5094126.
- Full binary diff: `/data/patch_diffs/mfmkvsrcsnk_dll-cve-2026-48574-ghidriff.md`