HEVC Video Extensions

Question

Hi All

i have the below vulnerability on Windows 11 VM hosted in Azure.

The Windows 'HEVC Video Extensions' or 'HEVC from Device Manufacturer' app installed on the remote host is affected by a remote code execution vulnerability

Upgrade to app version 2.0.51121.0, 2.0.51122.0, or later via the Microsoft Store

i checked in Microsoft Store under library but i am unable to see any app with HEVC.

Answer 1

Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query

It appears that the HEVC Video Extensions and HEVC from Device Manufacturer apps are not available on the Microsoft Store. To upgrade to a secure version, you should download the latest version of the apps directly from the developer's website. Alternatively, you can try using a third-party tool such as Advanced System Protector to scan and secure your system.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.

Answer 2

Glenn,

There are 2 independent separate apps. One is 'HEVC Video Extensions' and the other is 'HEVC from Device Manufacturer.'

The Device Manufacturer one is the original one. It was free. It was included in some of the older earlier Windows 10/Windows 11 builds and installed automatically when those builds were installed on a new system that - apparently - had an Intel Kaby Lake or later CPU.

If you have that on your system, then Windows Updates will automatically keep it updated to the latest version - as of this writing it's 2.0.60091.0

It allows for playing of H.265 videos in Windows Media Player. The reason it was free is because - allegedly - it ONLY worked with CPU's that had the H.265/HEVC hardware codec in the CPU itself.

SUPPOSEDLY it also allowed for playing HEVC videos - such as 4k videos from Netflix - in the Edge web browser.

However, it APPEARS that the latest versions of Edge - 110.0.1587.56 as of this writing - are unable to use this codec. Only Media Player/Windows Media Player still can use it.

This app USED to be visible in the Microsoft Store. However, Microsoft discovered that people could install this on any computer regardless of the CPU by going to the Store. They finally removed all references to it from the Store. I do not know if this is because they intended to break its compatibility with Edge or for some other reason. Most likely, it was a support issue. It is NOT a license fee issue because the license fee for the HEVC codec would have already been paid by the CPU maker.

The OTHER codec is "HEVC Video Extensions" This is a PAID app that costs 99 cents. This app SUPPOSEDLY will use a hardware decoder in the CPU if one is present, and if one is NOT present then it WILL decode using a software decoder that runs as a process in Windows. This does in fact work with the latest version of Edge to play H.265 videos.

SUPPOSEDLY the latest version of Chrome will also play H.265/HEVC videos IF the CPU has a hardware codec for HEVC, without having to buy this app. However, I have not found this to be true under Windows 10. It may be true under Windows 11.

There are multiple open source H.265 software codecs available but according to the convoluted licensing on the HEVC patent, anyone building a working codec from those free sources is liable for patent royalties. Because the source of Chrome is open source, located at https://chromium.googlesource.com/ it is possible to build this along with one of the open source codecs and create a version of Chrome that supports H.265 regardless of whether or not the CPU has a hardware codec in it. A few people have done this and put up distributions for a while until they either lost interest or MPEG-LA filed takedown requests. There is currently one such distribution active in an overseas location you can search for if you want to avoid the 99 cent fee and you have a CPU that is pre-Kaby Lake. One warning about using distributions like this is since you don't know who compiled them they might have spyware embedded in them so be careful.

I don't know why Microsoft is charging the 99 cents but I am pretty sure it is because they compiled in a software HEVC codec in their app, and if for whatever reason Edge can't use the hardware codec in the CPU it switches to the software codec. I know for a fact they DO have a software HEVC in the 99 cent extension because I have it running on a pre-Kaby Lake CPU and Edge does in fact display H.265 video with it (it did NOT prior to loading that app)

If their extension ONLY used the CPU's codec then they would NOT need to pay a patent fee to MPEG LA and they would not have to charge 99 cents and then fork that over to MPEG LA.

Because of the exorbitant patent fees for HEVC, the major CPU manufacturers are moving to a new codec created by Alliance for Open Media which does even better compression of video. However, there are very few machines that have support for it, they have to be Intel Tiger Lake or better CPUs. The other larger problem with AV1 is that while it does have better compression, the CPU requirements to create an AV1 video are enormous and out of the question for older CPUs. Decompression of AV1 is much faster but still for seamless performance the user needs a hardware codec.

Answer 3

Waiting to hear from MSFT

PAID FOR HVEC EXTENSION - MSFT STORE DOES NOT SAY I OWN IT
Hi. February 21, 2022, I paid MSFT Store for the HEVC Video Extensions codec. Recently, did a clean install of Win 10 on the same computer. MSFT Store says I do not own the app. What do I do?

February 21, 2022 | Order number 3659634052

HEVC Video Extensions

$0.99

Completed

Total $1.07

Paid with PayPal (******@gmail.com)

Answer 4

I want this extension because i need it for my son's birthday so that i can use all the video's on the slideshow without any problems and i do not trust the app that cost $1. It could be a scam if i use my credit card. Thank you