Microsoft HEVC Video Extension: Heap Out-of-Bounds Write via an Unclamped NumDeltaPocs in st_ref_pic_set

Presentation

The HEVC Video Extension is the Microsoft Store package that adds H.265 decoding to Windows, and Microsoft tracks it as part of the Windows Codecs Library. Windows calls it on its own to build a thumbnail or a preview for a video file.

HDW Sec found a heap out-of-bounds write in its parsing of short-term reference picture sets. st_ref_pic_set derives NumDeltaPocs from the bitstream and uses that count without clamping it to the bound the format allows.

As with the image codecs, the victim never plays the file: listing it in a folder that Windows thumbnails is enough. Microsoft rates the issue Critical, scores it 7.8 (temporal 6.8) with a local attack vector and records the impact as remote code execution.

Issue(s)

• st_ref_pic_set computes NumDeltaPocs from values read in the bitstream and uses it without clamping it to the bound the HEVC syntax places on a short-term reference picture set.
• That count drives writes into a heap buffer sized for the legal maximum, so a stream declaring more entries than the format allows writes past the end of the buffer.
• The parser is reached from the decode path used by the Windows thumbnail and preview handlers, so the file only has to be listed in a folder for the corruption to occur.
• Microsoft classifies the flaw as CWE-122 (heap-based buffer overflow). HDW Sec tracks it as a heap out-of-bounds write (CWE-787).
• Microsoft assigns the exploitability index “Exploitation Less Likely” and reports the vulnerability as neither publicly disclosed nor exploited at publication.
• The fix ships as three distinct Store packages, so a host can stay vulnerable through one of them while another is already up to date.

References

• Microsoft Security Update Guide: CVE-2026-58599
• MITRE record: CVE-2026-58599
• Fix delivered through the Microsoft Store on 2026-09-08: HEVC Video Extensions 2.4.87.0, HEVC Video Extensions from Device Manufacturer 2.4.86.0 for Windows 10, Windows 11 23H2 and 24H2 and Windows Server, then 2.5.25.0 for Windows 11 25H2 and 26H1, and HEVC Video Extensions for Licensed Applications 2.4.85.0.