Microsoft has published details on CVE-2026-62744, a heap-based buffer overflow in Windows Media Foundation that allows unauthorized remote code execution with a CVSS score of 8.8. The flaw requires a user to open a specially crafted media file and is included in the September 2026 security updates.
It allows an unauthorized attacker to execute code over a network.
No public disclosure or active exploitation is noted at the time of release.
Enterprises should prioritize the September 2026 patch bundle and monitor for user-targeted lures involving media files, as the high confidentiality and integrity impact could enable broad system compromise.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
CISA has added CVE-2026-114625, a critical SQL injection bug in Arista VeloCloud Orchestrator, to its KEV catalog with an October 26 deadline. Fixed releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12.
CISA added CVE-2026-110447, an OS command injection flaw in Collabora Online's built-in CODE server used within Nextcloud, to its Known Exploited Vulnerabilities catalog on October 23. It allows remote code execution; federal agencies must mitigate by October 26 under BOD 26-04.
Oracle has patched CVE-2026-91241, a flaw in Oracle Business Intelligence Enterprise Edition that it rates 9.1 Critical under CVSS 3.1, in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. The fix shipped in Oracle's October 2026 Critical Patch Update, and Oracle urges customers to apply it promptly.
Microsoft assesses that Storm-0940, a group it calls China-state aligned, was behind the ConnectWise Cloud Backup supply-chain compromise. Microsoft says the group used the open-source agentic AI framework ARTEX to abuse already-consented app identities to sign in to Microsoft 365 tenants, with follow-on Microsoft Graph activity in some of them.
Capcom says about 11.77 million CAPCOM ID records were exposed, each with an email address and login metadata. 43 also exposed birth date, gender, country and nickname, and 196 accounts had passwords changed without authorization and reset. Capcom says it has not confirmed any compromise of customer-set passwords, and credit card information was not included.
