---
id: "CVE-2026-105534"
page: "https://infrastack.ai/live/CVE-2026-105534"
kind: "vulnerability"
aliases: ["CVE-2026-105534"]
title: "Windows Storage: heap overflow can run code on a client that connects to a malicious server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Storage", "fixed": [], "affected": "?", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "rce", "user-interaction-required", "windows", "windows-storage"]
not_affected_if: []
published_at: "2026-11-10T19:17:54+00:00"
first_seen_at: "2026-11-10T19:24:18+00:00"
updated_at: "2026-11-11T01:00:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105534", "first_seen_at": "2026-11-10T19:24:18+00:00"}, {"source": "analyst", "url": "https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-105534", "first_seen_at": "2026-11-11T01:00:14+00:00", "cites": ["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-105534"]}]
exploit_sources: []
---

# Windows Storage: heap overflow can run code on a client that connects to a malicious server

Link for people: https://infrastack.ai/live/CVE-2026-105534 (this .md is for agents)

Microsoft (November 2026 Patch Tuesday, released 2026-11-10) rates this Important, CVSS 8.8. A heap-based buffer overflow (CWE-122) in Windows Storage lets an attacker run code on a Windows client. Per Microsoft's FAQ, the attacker hosts a malicious server and a user must connect to it from an affected client, so user interaction is required. Microsoft marks it not exploited, not publicly disclosed, 'Exploitation Less Likely'. The API response lists no KB numbers or fixed builds.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Storage affected ? fixed no fixed version listed

## How to check

Open the Microsoft Security Update Guide entry for CVE-2026-105534 and find the KB for your Windows version. Then confirm it is installed: Get-HotFix -Id KBxxxxxxx, or Settings > Windows Update > Update history. Per-version KBs and builds were not readable from Microsoft's API (unknown).

## Fix

Install the November 2026 Windows cumulative security update for your Windows version (Microsoft: customer action required). Exact KB and build numbers unknown; not in the API response.

## Timeline

- 2026-11-10T19:24:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105534
- 2026-11-11T01:00:14+00:00 analyst https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-105534 — Read MSRC API JSON (primary). No KB/build list or mitigations available there; JS-only guide page unreachable. Triage's 'without authentication' is true (PR:N) but UI:R applies, so I corrected the title and summary. Nothing marked verified because affected builds are missing. X and search not used.

## Documents

- [advisory] MSRC: CVE-2026-105534 Windows Storage Remote Code Execution Vulnerability https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-105534

## From the sources

Heap-based buffer overflow in Windows Storage allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_