The bugs in this codec are triggered through HEIC images (HEIFextension package. This extension is not installed by default. 'The vulns are in the hevcdecoder_store.dll extension (HEVC codec package).

Zero Day Initiative researcher AbdulAziz Hariri, who found these vulnerabilities, provided some additional details to BleepingComputer. Get-AppxPackage -Name Microsoft.HEVCVideoExtension The FAQ also mentions that the fixed version of the HEVC extensions is 2.0, 3.0 and that the following PowerShell command can be used to check the installed package version. Microsoft states that these are optional packages and that only those people who have them installed would receive the update. This package is available from the Microsoft Store as the packages named ' HEVC Video Extensions' or ' HEVC Video Extensions from Device Manufacturer.' On July 1st, Microsoft updated the advisories to include a FAQ that explained that Windows Server was not affected and that the vulnerabilities are in the HEVC Video Extensions. Vulnerabilities in the HEVC Video Extensions Instead of delivering these security updates via Windows Update, Microsoft is rolling them out via auto-updates on the Microsoft Store.Įven more confusing, the advisories did not explain what Microsoft Store apps would be updated to resolve the vulnerabilities, leaving users in the dark as to whether they were affected and patched by an update. They stated that they affected both Windows 10 and Windows Server at the time. On June 30th, Microsoft released two out-of-band security updates for remote code execution vulnerabilities in the Windows Codecs Library. When Microsoft releases security updates for Windows, they are almost always released via Windows Update or by standalone updates that can be downloaded from the Microsoft Catalog. Microsoft released security updates via the Microsoft Store last week, and it's confusing many users who want to make sure their devices are protected.

Hevc video extensions windows 7