Local code execution via heap buffer overflow

Heap-based buffer overflow in Windows Media on affected Windows releases allows local authenticated users to execute arbitrary code. Microsoft has not disclosed the affected parser, malformed input, or operation that writes beyond the allocated heap buffer. A low-privilege local account is required; successful exploitation runs code through Windows Media and can compromise host data and operation.