{"id":"CVE-2026-112743","kind":"vulnerability","aliases":["CVE-2026-112743"],"related":[],"title":"Windows Device Association Service: local user can gain elevated privileges","description":"Untrusted pointer dereference in Windows Device Association Service allows an authorized attacker to elevate privileges locally.","summary":"A flaw in the Windows Device Association Service lets an authorized local attacker dereference an untrusted pointer and raise their privileges. The attacker must already be able to run code or log on to the machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"},{"name":"Windows Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","local","privilege-escalation","windows","windows-server"],"not_affected_if":["no-untrusted-local-users","patched-nov-2026"],"how_to_check":"Run winver or [System.Environment]::OSVersion / (Get-ComputerInfo).OsBuildNumber and compare the full build (e.g. 10.0.26100.xxxx) with the fixed build for your version; anything below it is exposed.","fix":"Install the November 2026 Windows cumulative update, which brings the build to at least the fixed build for your version (e.g. Win 11 24H2 10.0.26100.9974, Win 10 22H2 10.0.19045.7846, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822). KB numbers not read.","status":"open","published_at":"2026-11-10T19:18:34+00:00","first_seen_at":"2026-11-10T19:24:31+00:00","triaged_at":"2026-11-10T19:42:19+00:00","updated_at":"2026-11-11T00:15:04+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:42:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Device Association Service: local user can gain elevated privileges","impact":"high","summary":"A flaw in the Windows Device Association Service lets an authorized local attacker dereference an untrusted pointer and raise their privileges. The attacker must already be able to run code or log on to the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Check the Microsoft security update guide for CVE-2026-112743 for affected builds, the patch, and whether the service is on by default.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Machines running Windows where the Device Association Service is present and an untrusted local user has an account. The sources do not name affected Windows builds or whether the service is enabled by default. Systems with only trusted local users have lower exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000659,"input_tokens":4490,"output_tokens":419,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft security update guide for CVE-2026-112743 for affected builds, the patch, and whether the service is on by default.","search":"'-112743':13A,16A '-2026':12A,15A '10':24A '11':18A,21A '2016':37A '2019':34A '2022':28A '2025':31A '22h2':25A '24h2':19A '25h2':22A 'abl':73B 'allow':91C 'alreadi':71B 'associ':3A,53B,89C 'attack':59B,69B,94C 'author':57B,93C 'code':76B 'cve':11A,14A 'derefer':60B,85C 'devic':2A,52B,88C 'elev':9A,96C 'escal':42B 'flaw':48B 'gain':8A 'infrastructur':38B 'let':55B 'local':5A,39B,58B,98C 'log':78B 'machin':82B 'must':70B 'pointer':63B,84C 'privileg':10A,41B,67B,97C 'privilege-escal':40B 'rais':65B 'run':75B 'server':27A,30A,33A,36A,46B 'servic':4A,54B,90C 'untrust':62B,83C 'user':6A 'window':1A,43B,45B,51B,87C 'windows':17A,20A,23A,26A,29A,32A,35A 'windows-serv':44B","nicknames":[],"mitigations":[],"who_affected":"Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022, 2025 builds below the November 2026 fixed builds. An attacker needs a local low-privilege account or code execution to reach SYSTEM. Machines with only trusted users, or already patched, can skip it; it is not reported as exploited.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1022h2","1124h2","1125h2","server2016","server2019","server2022","server2025","windows1022h2","windows1124h2","windows1125h2","windowsserver2016","windowsserver2019","windowsserver2022","windowsserver2025"],"ptokens":["10","11","2016","2019","2022","2025","22h2","24h2","25h2","server","windows"],"labels":["high","infrastructure","local","privilegeescalation","windows","windowsserver"],"campaign_type":null,"search_a":"'-112743':13A,16A '-2026':12A,15A '10':24A '11':18A,21A '2016':37A '2019':34A '2022':28A '2025':31A '22h2':25A '24h2':19A '25h2':22A 'associ':3A 'cve':11A,14A 'devic':2A 'elev':9A 'gain':8A 'local':5A 'privileg':10A 'server':27A,30A,33A,36A 'servic':4A 'user':6A 'window':1A 'windows':17A,20A,23A,26A,29A,32A,35A","search_b":"'abl':73B 'alreadi':71B 'associ':53B 'attack':59B,69B 'author':57B 'code':76B 'derefer':60B 'devic':52B 'escal':42B 'flaw':48B 'infrastructur':38B 'let':55B 'local':39B,58B 'log':78B 'machin':82B 'must':70B 'pointer':63B 'privileg':41B,67B 'privilege-escal':40B 'rais':65B 'run':75B 'server':46B 'servic':54B 'untrust':62B 'window':43B,45B,51B 'windows-serv':44B","search_c":"'allow':91C 'associ':89C 'attack':94C 'author':93C 'derefer':85C 'devic':88C 'elev':96C 'local':98C 'pointer':84C 'privileg':97C 'servic':90C 'untrust':83C 'window':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112743","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112743","severity":null,"published_at":"2026-11-10T19:18:34+00:00","modified_at":"2026-11-10T19:18:34+00:00","first_seen_at":"2026-11-10T19:24:31+00:00","fetched_at":"2026-11-10T19:24:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112743:3307","url":"https://nvd.nist.gov/vuln/detail/cve-2026-112743","severity":null,"published_at":"2026-11-11T00:15:04+00:00","modified_at":"2026-11-11T00:15:04+00:00","first_seen_at":"2026-11-11T00:15:04+00:00","fetched_at":"2026-11-11T00:15:04+00:00","note":"MSRC page is JS-only and unreadable; builds taken from NVD (Microsoft CNA data), Rapid7 says Exploitation Less Likely, not exploited. Nothing verified; MSRC page and KB numbers unread. Default-on status of service not stated.","cites":["https://nvd.nist.gov/vuln/detail/cve-2026-112743","https://www.rapid7.com/blog/post/patch-tuesday-november-2026-em/"]}],"documents":[{"id":120570,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-112743","title":"NVD CVE-2026-112743 (Microsoft CNA affected builds)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120546,"url":"https://www.rapid7.com/blog/post/patch-tuesday-november-2026-em/","title":"Rapid7 Patch Tuesday November 2026","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}