{"id":"CVE-2026-112794","kind":"vulnerability","aliases":["CVE-2026-112794"],"related":[],"title":"Windows Smart Card: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Smart Card component lets a logged-in attacker corrupt memory and elevate their privileges on the machine. The sources rate it high severity (CVSS 7.8) and report no known exploitation.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Smart Card","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","smart-card","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:41+00:00","first_seen_at":"2026-11-10T19:24:33+00:00","triaged_at":"2026-11-10T19:42:15+00:00","updated_at":"2026-11-10T19:42:15+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:42:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Smart Card: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Smart Card component lets a logged-in attacker corrupt memory and elevate their privileges on the machine. The sources rate it high severity (CVSS 7.8) and report no known exploitation.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","smart-card"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Confirm affected Windows builds and the Microsoft patch/KB from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-112794) or Microsoft's update guide.","how_to_check":"unknown","plain_action":"","product_name":"Windows Smart Card","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Windows machines using the Smart Card component, where an attacker already has an authorized local account can escalate privileges. Systems without a local attacker who can log in, or without smart card use, are less exposed; the sources do not say which Windows builds are affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4492,"output_tokens":510,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Windows builds and the Microsoft patch/KB from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-112794) or Microsoft's update guide.","search":"'-112794':15A,18A '-2026':14A,17A '7.8':61B 'allow':76C 'attack':44B,79C 'author':78C 'base':30B,69C 'buffer':31B,70C 'card':3A,21A,25B,37B,75C 'compon':38B 'corrupt':45B 'cve':13A,16A 'cvss':60B 'elev':48B,81C 'exploit':66B 'gain':10A 'heap':4A,29B,68C 'heap-bas':28B,67C 'high':58B 'higher':11A 'infrastructur':22B 'known':65B 'let':6A,39B 'local':8A,83C 'log':42B 'logged-in':41B 'machin':53B 'memori':46B 'overflow':5A,32B,71C 'privileg':12A,50B,82C 'rate':56B 'report':63B 'sever':59B 'smart':2A,20A,24B,36B,74C 'smart-card':23B 'sourc':55B 'user':9A 'window':1A,26B,35B,73C 'windows':19A","nicknames":[],"mitigations":[],"who_affected":"Windows machines using the Smart Card component, where an attacker already has an authorized local account can escalate privileges. Systems without a local attacker who can log in, or without smart card use, are less exposed; the sources do not say which Windows builds are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["smartcard","windowssmartcard"],"ptokens":["card","smart","windows"],"labels":["high","infrastructure","smartcard","vendor","windows"],"campaign_type":null,"search_a":"'-112794':15A,18A '-2026':14A,17A 'card':3A,21A 'cve':13A,16A 'gain':10A 'heap':4A 'higher':11A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'smart':2A,20A 'user':9A 'window':1A 'windows':19A","search_b":"'7.8':61B 'attack':44B 'base':30B 'buffer':31B 'card':25B,37B 'compon':38B 'corrupt':45B 'cvss':60B 'elev':48B 'exploit':66B 'heap':29B 'heap-bas':28B 'high':58B 'infrastructur':22B 'known':65B 'let':39B 'log':42B 'logged-in':41B 'machin':53B 'memori':46B 'overflow':32B 'privileg':50B 'rate':56B 'report':63B 'sever':59B 'smart':24B,36B 'smart-card':23B 'sourc':55B 'window':26B,35B","search_c":"'allow':76C 'attack':79C 'author':78C 'base':69C 'buffer':70C 'card':75C 'elev':81C 'heap':68C 'heap-bas':67C 'local':83C 'overflow':71C 'privileg':82C 'smart':74C 'window':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112794","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112794","severity":null,"published_at":"2026-11-10T19:18:41+00:00","modified_at":"2026-11-10T19:18:41+00:00","first_seen_at":"2026-11-10T19:24:33+00:00","fetched_at":"2026-11-10T19:24:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}