# CVE-2026-57094 — Windows Media Foundation `mfds.dll` HEVC Inter-RPS Prediction Unbounded Write → Heap Buffer Overflow

---

## Summary

| | |
|---|---|
| **Product** | Windows — `mfds.dll` (Media Foundation — HEVC/H.265 decoder support) |
| **CVE ID** | CVE-2026-57094 |
| **Impact** | Remote Code Execution (open a crafted media file) |
| **MSRC severity** | Critical |
| **CVSS** | 8.8 / 7.7 — `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-122: Heap-based Buffer Overflow (with CWE-125: Out-of-bounds Read) |
| **Delivery** | Network / file — victim opens a specially crafted HEVC media file |
| **KB / Fixed build** | KB5101650 — `mfds.dll` 10.0.26100.8875 (Win11 24H2 x64) |
| **Patch Date** | July 14, 2026 (2026-Jul) |
| **Pre-patch binary** | `mfds.dll` 10.0.26100.8328 (KB5094126) — SHA256 `6f5a484f1971aae128fa20cf7f024ef11d9768ff9614ac262a054f30e0b31237` |
| **Post-patch binary** | `mfds.dll` 10.0.26100.8875 (KB5101650) — SHA256 `19641f0aaa775981663d538b508c56e4d5a8ef1122d412a6c15ac7f2802c93d4` |
| **Feature flag** | `Feature_1136894267` — **the fix is CFR-gated** (this is the flag present in the analysed ghidriff; an alternate decompilation cites `Feature_1405329723`) |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`mfds.dll` provides Media Foundation decoder support including the **HEVC (H.265)**
bitstream parser (`CHEVCParser`). HEVC slices reference **short-term reference picture
sets (RPS)**, parsed by `CHEVCParser::parseShortTermRefPicSet` into a
`ReferencePictureSet` structure. That structure is **0x140 bytes** (its constructor
`memset`s `0x140`); its per-entry `DeltaPOC` array begins at `+0x20` and the per-entry
"used" flags at `+0xA0`, with a maximum of **16 entries**.

---

## Vulnerability Summary

`parseShortTermRefPicSet` has two ways to fill an RPS: an **explicit** branch (entries
read directly from the bitstream) and an **inter-RPS prediction** branch (entries derived
from a previously parsed set). Pre-patch, the explicit branch enforced the 16-entry limit
(`if (count > 0x10) return 0`), but the **inter-RPS prediction branch performed no
equivalent bound** on its write index — it iterated over the referenced set's entry count
and wrote `DeltaPOC[idx]` (`+0x20`) and `used[idx]` (`+0xA0`) with an index that was never
compared against 16, then stored the resulting count as the bound for the *next* set. A
crafted HEVC bitstream can therefore drive the prediction branch to write **past the end
of the 0x140-byte `ReferencePictureSet`** — a heap-based buffer overflow (CWE-122), with
out-of-bounds reads of the referenced set (CWE-125). Because a user need only **open a
crafted media file** (`AV:N`, `UI:R`), this is a remote code-execution primitive
(Microsoft rates it **Critical, 8.8**).

---

## Prerequisites and Constraints

- The victim opens / plays a specially crafted HEVC (H.265) media file (`AV:N`, `UI:R`,
  `PR:N`).
- The file's short-term RPS uses inter-RPS prediction to grow the entry count beyond 16.
- Result: the prediction branch writes `DeltaPOC`/`used` entries past the 0x140-byte
  structure.

---

## Vulnerability Details

### Root Cause

The inter-RPS prediction branch of the HEVC short-term RPS parser did not bound its
write index to the 16-entry maximum that the explicit branch enforced, so a crafted
predicted set could overflow the `ReferencePictureSet` structure.

### The patch (confirmed — diff, .8328 → .8875)

Gated behind the CFR feature flag, the fix introduces a **bounded accessor
`ReferencePictureSet::setDeltaPOC`** and routes the prediction branch's writes through it,
and adds the parser-level bound so the inter-RPS branch is held to the same 16-entry limit:

```c
// ReferencePictureSet::setDeltaPOC (10.0.26100.8875) — NEW, from the diff
void ReferencePictureSet::setDeltaPOC(ReferencePictureSet *this, int idx, int val) {
    if (!Feature_1136894267__private_IsEnabled() || (uint)idx < 0x10)   // *** 16-entry bound ***
        *(int *)(this + (longlong)idx * 4 + 0x20) = val;                //     DeltaPOC[idx]
}

// CHEVCParser::parseShortTermRefPicSet (10.0.26100.8875) — PATCHED prediction branch
if (Feature_1136894267__private_IsEnabled() && count >= 0x10) return 0;  // parser-level bound
...
DeltaPOC = (i >= refCount) ? 0 : ReferencePictureSet::getDeltaPOC(refSet, i);
ReferencePictureSet::setDeltaPOC(a2, idx, DeltaPOC + delta);             // bounded write (was raw +0x20)
```

Pre-patch the prediction branch wrote `*(a2 + idx*4 + 0x20) = ...` and `*(a2 + idx*4 +
0xA0) = ...` with no comparison of `idx` against 16. With the writes routed through the
bounded `setDeltaPOC` (and the parser rejecting an over-limit predicted count), the
prediction branch can no longer write past the `ReferencePictureSet`, closing the
overflow.

### Patch Completeness Assessment

**CFR-gated behind `Feature_1136894267`.** The bounded accessor / parser check runs only
when the flag is enabled; the original unbounded prediction branch still ships when
disabled. Verify the flag is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Heap-corruption crashes in Media Foundation
(`mfds!CHEVCParser::parseShortTermRefPicSet`) when opening/playing HEVC media on
unpatched/flag-disabled builds; malformed HEVC files whose short-term RPS uses inter-RPS
prediction with an entry count > 16. Treat untrusted HEVC/H.265 media as risky.

**Config.** The fix is CFR-gated — confirm `Feature_1136894267` is enabled.

---

## References

- MSRC advisory — CVE-2026-57094 (Microsoft Windows Media Foundation Remote Code Execution), released 2026-07-14, KB5101650.
- Full binary diff: `/data/patch_diffs/mfds_dll-cve-2026-57094-ghidriff.md`