# CVE-2026-50655 — Windows Media Foundation `mfaudiocnv.dll` Output-Buffer Size Integer Overflow → Heap Buffer Overflow

---

## Summary

| | |
|---|---|
| **Product** | Windows — `mfaudiocnv.dll` (Media Foundation audio converter / DTS audio MFT) |
| **CVE ID** | CVE-2026-50655 |
| **Impact** | Remote Code Execution (local; arbitrary code execution — open a crafted media file) |
| **MSRC severity** | Critical |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-122: Heap-based Buffer Overflow (via 32-bit integer overflow) |
| **Delivery** | Local — victim opens / plays a specially crafted audio (DTS) media file |
| **KB / Fixed build (diffed lineage, Server 2016)** | KB5099535 — `mfaudiocnv.dll` 10.0.14393.9339 |
| **Patch Date** | July 14, 2026 (2026-Jul) |
| **Pre-patch binary** | `mfaudiocnv.dll` 10.0.14393.4169 — SHA256 `6694122c1d70ce30bd466219d3be3a50286a064a469461b3dfa7efba503f3b07` |
| **Post-patch binary** | `mfaudiocnv.dll` 10.0.14393.9339 — SHA256 `922eaa518b97264a8ea2d0f65def01f376b108967831d6a5c8b73a091eec4d2f` |
| **Feature flag** | `Feature_2888010040` (`_CreateNewOutputBuffer`) / `Feature_3712716091` (`_AppendPacketToOutputBuffer`) — **the fix is CFR-gated** |
| **Exploitability** | Exploitation More Likely; not publicly disclosed; not exploited (per MSRC) |

> Lineage note: this diff is the **Server 2016 (build 14393)** pair `.4169 → .9339`
> (KB5099535); despite the large version gap the code delta is small (14393 is serviced
> rarely). Cross-checked against an independent writeup — the size-addition sites and the
> monotonicity fix match the ghidriff. (The writeup cites `Feature_2552465720`; this build
> gates the two functions with `Feature_2888010040` / `Feature_3712716091` via the ReFS-style
> velocity `EvaluateCurrentState` mechanism.)

---

## Product Description

`mfaudiocnv.dll` is a Media Foundation audio converter (the DTS audio MFT,
`CDTSMFTDataHandler`). When it produces output samples it computes the required output-buffer
size by **adding a fixed header size to the payload length** — e.g. `payload + 8`,
`payload + 4`, and `payload + 0x13` (19, aligned) — in `_CreateNewOutputBuffer` and
`_AppendPacketToOutputBuffer`, then compares it against the buffer capacity before writing.

---

## Vulnerability Summary

Pre-patch, the required size was computed as `payload_length + header` in **32-bit
arithmetic** and compared (unsigned) against the buffer capacity. For a crafted media stream
whose payload length is near `0xFFFFFFFF`, the addition **wraps to a small value**, so the
capacity check passes even though the real data is far larger; the subsequent copy then
writes past the output buffer — a heap-based buffer overflow (CWE-122). Because a user need
only **open/play a crafted audio file** (`AV:L`, `UI:R`), it is an arbitrary-code-execution
primitive (Microsoft rates it **Critical, 7.8**).

---

## Prerequisites and Constraints

- Local, user interaction (`AV:L`, `AC:L`, `PR:N`, `UI:R`): the victim opens/plays a crafted
  DTS/media file that reaches the audio converter.
- The payload length is chosen so `payload + header` overflows the 32-bit size computation.
- Result: the capacity check is bypassed and the output buffer is overrun.

---

## Vulnerability Details

### Root Cause

The output-buffer size was `payload_length + header_size` in 32-bit with no overflow check,
so a near-`UINT_MAX` payload wrapped the sum to a small value that passed the capacity
comparison while the real copy overran the buffer.

### The patch (confirmed — diff, .4169 → .9339)

Gated behind the CFR feature flags, `_CreateNewOutputBuffer` and `_AppendPacketToOutputBuffer`
add a **monotonicity check** at each size addition — if `payload + header < payload` the add
wrapped, so the operation is rejected (`0x8000FFFF`, `E_UNEXPECTED`) before the size is used:

```c
// CDTSMFTDataHandler::_CreateNewOutputBuffer (10.0.14393.9339) — PATCHED (from the diff)
if (EvaluateCurrentState(&g_Feature_2888010040_...)) {
    uVar3 = payload + 8;
    if (uVar3 < payload) {                       // *** 32-bit add wrapped -> reject ***
        *(uint*)(ctx + 0x7cc) = 0x8000ffff;      // E_UNEXPECTED
    } else {
        ... use uVar3 as the required size / compare to capacity ...
    }
}

// CDTSMFTDataHandler::_AppendPacketToOutputBuffer (.9339) — PATCHED
if (EvaluateCurrentState(&g_Feature_3712716091_...)) {
    if (payload + 8 + this->hdr <= capacity) { ... }   // guarded size vs capacity
    // and the aligned path (payload + 0x13 + hdr) & ~0xF is checked against capacity too
}
```

The same guard is applied to the other size calculations in the function (`payload + 4`,
`payload + 0x13 + hdr`). With every `header + payload` addition checked for wraparound before
it drives the capacity comparison and copy, a crafted near-`UINT_MAX` payload can no longer
bypass the bound, closing the overflow.

### Patch Completeness Assessment

**CFR-gated** (`Feature_2888010040` / `Feature_3712716091`). The overflow guards run only when
the flags are enabled; the original unchecked additions still ship when disabled. Verify the
flags are enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Heap-corruption crashes in `mfaudiocnv!CDTSMFTDataHandler::_CreateNewOutputBuffer`
/ `_AppendPacketToOutputBuffer` when decoding/converting audio on unpatched/flag-disabled
builds; malformed DTS/audio media with extreme payload-length fields. Treat untrusted audio
media as risky.

**Config.** The fix is CFR-gated — confirm `Feature_2888010040` / `Feature_3712716091` are enabled.

---

## References

- MSRC advisory — CVE-2026-50655 (Microsoft Windows Media Foundation Remote Code Execution), released 2026-07-14, KB5099535 (Server 2016) and per-SKU KBs.
- Full binary diff: `/data/patch_diffs/mfaudiocnv_dll-cve-2026-50655-ghidriff.md`