Microsoft · Memory corruption
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network
At a glance
~0.8% estimated chance of attack in 30 days. Exploitation not confirmed.
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
There is no written leader briefing for this story yet. These questions come from the facts we hold.
Questions to ask IT
- Do we run Microsoft Windows and Microsoft Office, and which versions?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 13 Dec?
Next steps
- Confirm whether this affects systems or suppliers in your estate
Vulnerability facts
Full CVE detail CVE-2026-113749- 7.5 · HighExploitable over the network without any account, under specific conditions, but only if a user takes an action, such as opening a file or link. High impact on confidentiality, integrity and availability.CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Not listed
- ~0.8% estimated chance of attack in 30 days
- Not linked from the CVE record
No technical write-up beyond these facts and the summary below yet.
Next steps
- Review the advisory against your asset inventory and patch cadence
Summary
- Added Microsoft Office software to the Security Updates table. Customers that are running supported version of Microsoft Office are encouraged to update to the indicated version to be protected from this vulnerability.
- CVE-2026-113749 has an estimated ~0.8% chance of attack in 30 days (56.7th percentile) as of 2026-11-13 — probability signal, not confirmed exploitation
Read the original reportMicrosoft Security Update Guide RSS(opens in a new tab)
Products and services involved
- Microsoft Windows98% match confidence · CVE-2026-113749
- Microsoft Office98% match confidence · CVE-2026-113749
Pulse
Last change 2h ago · Next recheck 14 Nov 2026, 23:11 UK time
- Story13 Nov 2026, 23:11 UK time · 2h ago
Linked reporting from Microsoft Security Update Guide RSS (vendor psirt).
Read source (Microsoft Security Update Guide RSS)
1 entry so far. The timeline chart appears once this story has more history.
Sources
CVE-2026-113749 Microsoft Windows Codecs Library Remote Code Execution Vulnerability
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorised attacker to execute code over a network
- ProbableSummary fact75% confidence
Added Microsoft Office software to the Security Updates table. Customers that are running supported version of Microsoft Office are encouraged to update to the indicated version to be protected from this vulnerability.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-113749
- ConfirmedEstimated attack likelihood95% confidence
CVE-2026-113749 has an estimated ~0.8% chance of attack in 30 days (56.7th percentile) as of 2026-11-13 — probability signal, not confirmed exploitation