Presentation
The HEVC Video Extension is the Microsoft Store package that adds H.265 decoding to Windows, and Microsoft tracks it as part of the Windows Codecs Library. The default media apps, Media Player and Photos, load its decoder HEVCDECODER_STORE.dll as soon as an HEVC video is opened.
HDW Sec found two distinct heap out-of-bounds writes in that decoder, reported separately and fixed in the same update. The first comes from a chroma format that the bitstream declares and the container contradicts. The second comes from the per-block quantization parameter (QP) map, which the decoder fills past its end. Microsoft publishes them as CVE-2026-114165 and CVE-2026-114167, under a shared title and description.
Microsoft rates both issues Important, scores them 7.8 (temporal 6.8) with a local attack vector and required user interaction, and records the impact as remote code execution.
Issue(s)
- Chroma format mismatch: the Matroska container announces 4:2:0 chroma in its
hvcCrecord, while the sequence parameter set of the stream declareschroma_format_idc = 3(4:4:4) under the Main profile, which does not allow 4:4:4. The decoder rejects neither the profile violation nor the contradiction with the container. - The output surface is negotiated from the 4:2:0 description of the container, but the block copy that writes the decoded picture into it follows the 4:4:4 layout of the stream (chroma stride 512 for a luma stride of 256 in the reproduction), so chroma samples are written outside the surface allocated for the picture.
- Confirmed in Microsoft Media Player, the default app for
.mkv, without page heap, onHEVCDECODER_STORE.dll2.5.33.0 under Windows 11 build 26200.9457: a byte write (mov byte ptr [r10+rdx],al) faults on the computed chroma destination, in unmapped memory next to the heap region that holds the luma plane. - QP map: the decoder keeps one QP entry per 4x4 unit in a heap map with a one-unit border, allocated as 4 x (W+2) x (H+2) bytes. In the reproduction, a 96x96 picture padded to 128x128 by 64x64 coding tree blocks gives a 34x34 map of 4,624 bytes.
- With tiles and entropy coding synchronization enabled in the picture parameter set, several decode threads fill the map concurrently, and a coding unit ends up with a size, read from the per-unit depth array, that contradicts its position, read from the z-scan index. The fill loop then writes rows 20 to 35 while only rows -1 to 32 exist, and nothing bounds the computed index.
- The written value is the QP of the block, so the stream sets the content of the overflow. Under full page heap, the first write lands 54 bytes past the end of the 4,624-byte block, and letting the loop finish shows 48 bytes written, one every four, up to 386 bytes past the end.
- Confirmed in Microsoft Photos, the shipped app, with the file opened through the normal shell path, on the same decoder build: with page heap, 8 crashes out of 20 openings, all on the same write (
HEVCDECODER_STORE.dll+0xC7FA7). Without page heap, 4 openings out of 20 ended withSTATUS_HEAP_CORRUPTION(0xC0000374) raised by the allocator itself, and one capture shows the overflowing bytes reaching an allocator pointer thatRtlFreeHeapthen dereferences. - Microsoft classifies both flaws as CWE-122 (heap-based buffer overflow). HDW Sec tracks them as heap out-of-bounds writes (CWE-787).
- Microsoft assigns the exploitability index “Exploitation Less Likely” to both and reports them as neither publicly disclosed nor exploited at publication.
- The fix ships as three distinct Store packages, so a host can stay vulnerable through one of them while another is already up to date.
References
- Microsoft Security Update Guide: CVE-2026-114165 and CVE-2026-114167
- MITRE records: CVE-2026-114165 and CVE-2026-114167
- Fix delivered through the Microsoft Store on 2026-11-10: HEVC Video Extensions 2.4.151.0, HEVC Video Extensions from Device Manufacturer 2.4.149.0 for Windows 10, Windows 11 23H2 and 24H2, then 2.5.48.0 for Windows 11 25H2, 26H1 and 26H2, and HEVC Video Extensions for Licensed Applications 2.4.150.0.