{"id":"CVE-2026-105580","kind":"vulnerability","aliases":["CVE-2026-105580"],"related":[],"title":"Windows Management Instrumentation: heap overflow lets a local user run code","description":"Heap-based buffer overflow in Windows Management Instrumentation allows an unauthorized attacker to execute code locally.","summary":"A heap-based buffer overflow in Windows Management Instrumentation lets an attacker who already has local access run code. NVD rates it high, CVSS 7.8.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows","wmi"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:00+00:00","first_seen_at":"2026-11-10T19:24:21+00:00","triaged_at":"2026-11-10T19:42:31+00:00","updated_at":"2026-11-10T19:42:31+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:42:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Management Instrumentation: heap overflow lets a local user run code","impact":"high","summary":"A heap-based buffer overflow in Windows Management Instrumentation lets an attacker who already has local access run code. NVD rates it high, CVSS 7.8.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","wmi"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local attacker runs code with elevated privileges on Windows","analyst_note":"Check the NVD entry and the Microsoft Security Update Guide for affected Windows builds, the fixed update, and the privilege level gained.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Windows machines where WMI is present, which is every supported Windows version. The sources do not list affected builds or say which configurations are exposed. The exploit needs local access, so a machine with no untrusted local users is lower risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":4496,"output_tokens":422,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the NVD entry and the Microsoft Security Update Guide for affected Windows builds, the fixed update, and the privilege level gained.","search":"'-105580':14A,17A '-2026':13A,16A '7.8':46B 'access':38B 'allow':56C 'alreadi':35B 'attack':33B,59C 'base':24B,49C 'buffer':25B,50C 'code':11A,40B,62C 'cve':12A,15A 'cvss':45B 'execut':61C 'heap':4A,23B,48C 'heap-bas':22B,47C 'high':44B 'infrastructur':18B 'instrument':3A,30B,55C 'let':6A,31B 'local':8A,37B,63C 'manag':2A,29B,54C 'nvd':41B 'overflow':5A,26B,51C 'rate':42B 'run':10A,39B 'unauthor':58C 'user':9A 'window':1A,19B,28B,53C 'wmi':20B","nicknames":[],"mitigations":[],"who_affected":"Windows machines where WMI is present, which is every supported Windows version. The sources do not list affected builds or say which configurations are exposed. The exploit needs local access, so a machine with no untrusted local users is lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows","wmi"],"campaign_type":null,"search_a":"'-105580':14A,17A '-2026':13A,16A 'code':11A 'cve':12A,15A 'heap':4A 'instrument':3A 'let':6A 'local':8A 'manag':2A 'overflow':5A 'run':10A 'user':9A 'window':1A","search_b":"'7.8':46B 'access':38B 'alreadi':35B 'attack':33B 'base':24B 'buffer':25B 'code':40B 'cvss':45B 'heap':23B 'heap-bas':22B 'high':44B 'infrastructur':18B 'instrument':30B 'let':31B 'local':37B 'manag':29B 'nvd':41B 'overflow':26B 'rate':42B 'run':39B 'window':19B,28B 'wmi':20B","search_c":"'allow':56C 'attack':59C 'base':49C 'buffer':50C 'code':62C 'execut':61C 'heap':48C 'heap-bas':47C 'instrument':55C 'local':63C 'manag':54C 'overflow':51C 'unauthor':58C 'window':53C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105580","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105580","severity":null,"published_at":"2026-11-10T19:18:00+00:00","modified_at":"2026-11-10T19:18:00+00:00","first_seen_at":"2026-11-10T19:24:21+00:00","fetched_at":"2026-11-10T19:24:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}