CVE-2026-95901

Summary

A double free vulnerability exists in Windows Microsoft DirectMusic, where repeated deallocation of the same memory region can corrupt heap structures. This flaw enables remote code execution (RCE) without authentication or user interaction over the network.

Exploitability

Exploitation requires network-level access to a vulnerable DirectMusic service; while no public exploit is known, the CVSS score and lack of authentication requirements indicate high exploitability potential for skilled attackers.

Blast radius

Successful exploitation could allow full system compromise (confidentiality, integrity, availability loss) on affected Windows systems, potentially enabling lateral movement or persistent access across enterprise networks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

No fixed version is published in the description; disable Microsoft DirectMusic functionality via Group Policy or registry settings, restrict network exposure of services using DirectMusic, and apply all available Windows security updates immediately.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.