{"id":"CVE-2026-112751","kind":"vulnerability","aliases":["CVE-2026-112751"],"related":[],"title":"Windows Remote Assistance use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Remote Assistance allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in Windows Remote Assistance lets an attacker who already has an authorized local account raise their privileges. The sources do not say which Windows versions are affected or what fixed build exists.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","remote-assistance","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:35+00:00","first_seen_at":"2026-11-10T19:24:31+00:00","triaged_at":"2026-11-10T19:42:19+00:00","updated_at":"2026-11-10T19:42:19+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:42:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Remote Assistance use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in Windows Remote Assistance lets an attacker who already has an authorized local account raise their privileges. The sources do not say which Windows versions are affected or what fixed build exists.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","remote-assistance"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the Windows machine","analyst_note":"Check the Microsoft security update guide entry for affected Windows builds, the fixed build, and whether Remote Assistance must be enabled.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Someone must already be authorized on the machine to exploit this, so it is a local privilege escalation, not a remote entry point. The sources do not list affected Windows builds or whether Remote Assistance must be enabled. Teams running Windows hosts with multiple local users should check for the vendor's patch.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":4482,"output_tokens":457,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft security update guide entry for affected Windows builds, the fixed build, and whether Remote Assistance must be enabled.","search":"'-112751':17A,20A '-2026':16A,19A 'account':45B 'affect':58B 'allow':71C 'alreadi':40B 'assist':3A,24B,35B,70C 'attack':38B,74C 'author':43B,73C 'bug':31B 'build':62B 'cve':15A,18A 'elev':76C 'exist':63B 'fix':61B 'free':7A,30B,66C 'gain':12A 'higher':13A 'infrastructur':21B 'let':8A,36B 'local':10A,44B,78C 'privileg':14A,48B,77C 'rais':46B 'remot':2A,23B,34B,69C 'remote-assist':22B 'say':53B 'sourc':50B 'use':5A,28B,64C 'use-after-fre':4A,27B 'user':11A 'version':56B 'window':1A,25B,33B,55B,68C","nicknames":[],"mitigations":[],"who_affected":"Someone must already be authorized on the machine to exploit this, so it is a local privilege escalation, not a remote entry point. The sources do not list affected Windows builds or whether Remote Assistance must be enabled. Teams running Windows hosts with multiple local users should check for the vendor's patch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","remoteassistance","windows"],"campaign_type":null,"search_a":"'-112751':17A,20A '-2026':16A,19A 'assist':3A 'cve':15A,18A 'free':7A 'gain':12A 'higher':13A 'let':8A 'local':10A 'privileg':14A 'remot':2A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A","search_b":"'account':45B 'affect':58B 'alreadi':40B 'assist':24B,35B 'attack':38B 'author':43B 'bug':31B 'build':62B 'exist':63B 'fix':61B 'free':30B 'infrastructur':21B 'let':36B 'local':44B 'privileg':48B 'rais':46B 'remot':23B,34B 'remote-assist':22B 'say':53B 'sourc':50B 'use':28B 'use-after-fre':27B 'version':56B 'window':25B,33B,55B","search_c":"'allow':71C 'assist':70C 'attack':74C 'author':73C 'elev':76C 'free':66C 'local':78C 'privileg':77C 'remot':69C 'use':64C 'window':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112751","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112751","severity":null,"published_at":"2026-11-10T19:18:35+00:00","modified_at":"2026-11-10T19:18:35+00:00","first_seen_at":"2026-11-10T19:24:31+00:00","fetched_at":"2026-11-10T19:24:31+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}