Microsoft Windows HEVC Video Extensions from Device Manufacturer < 2.4.86.0 / 2.5.25.0 RCE (October 2026)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(366539);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/16");
  script_cve_id("CVE-2026-108400");

  script_name(english:"Microsoft Windows HEVC Video Extensions from Device Manufacturer < 2.4.86.0 / 2.5.25.0 RCE (October 2026)");

  script_set_attribute(attribute:"synopsis", value:
"The Windows app installed on the remote host is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Windows 'HEVC Video Extensions from Device Manufacturer' app installed on the remote host is
prior to 2.4.86.0 (2.5.25.0 on Windows 11 versions 25H2 and 26H1). It is, therefore, affected by
a remote code execution vulnerability. Integer overflow or wraparound in Microsoft Windows Codecs
Library allows an unauthorized attacker to execute code over a network. Exploitation of the
vulnerability requires that a user open a specially crafted file from the attacker.

Note that Nessus has not tested for this issue but has instead relied only on the application's
self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108400");
  script_set_attribute(attribute:"solution", value:
"Upgrade the Windows 'HEVC Video Extensions from Device Manufacturer' app to version 2.4.86.0 (2.5.25.0
on Windows 11 versions 25H2 and 26H1) or later via the Microsoft Store.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-108400");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:hevc_video_extensions");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("smb_hotfixes.nasl", "wmi_enum_windows_app_store.nbin");
  script_require_keys("SMB/Registry/Enumerated", "WMI/Windows App Store/Enumerated");
  script_require_ports(139, 445);

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

#  Microsoft.HEVCVideoExtension - app preinstalled by the device manufacturer
var app = 'Microsoft.HEVCVideoExtension';

var app_info = vcf::microsoft_appstore::get_app_info(app:app);

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, app);

vcf::check_granularity(app_info:app_info, sig_segments:3);

# The Store ships the 2.5 branch of this app to Windows build 26200 and later and the 2.4 branch
# to earlier builds. MSRC lists 2.5.25.0 as the fix for Windows 11 25H2 (26200) and 26H1 (28000),
# so a 2.4.x install on those builds is still vulnerable. All other listed releases are fixed in
# 2.4.86.0.
var constraints;
var os_build = get_kb_item('SMB/WindowsVersionBuild');

if (!empty_or_null(os_build) && int(os_build) >= 26200)
{
  constraints = [
    { 'fixed_version' : '2.5.25.0' }
  ];
}
else
{
  constraints = [
    { 'fixed_version' : '2.4.86.0' },
    { 'min_version' : '2.5', 'fixed_version' : '2.5.25.0' }
  ];
}

vcf::microsoft_appstore::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);