{"id":"CVE-2026-112798","kind":"vulnerability","aliases":["CVE-2026-112798"],"related":[],"title":"Windows NetBIOS: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally.","summary":"A memory-handling flaw (use after free) in the Windows NetBIOS component lets an attacker who already has a local account raise their privileges. The sources do not say whether the attacker needs more than a standard logon.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","netbios","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:41+00:00","first_seen_at":"2026-11-10T19:24:33+00:00","triaged_at":"2026-11-10T19:53:37+00:00","updated_at":"2026-11-10T19:53:37+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:53:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows NetBIOS: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A memory-handling flaw (use after free) in the Windows NetBIOS component lets an attacker who already has a local account raise their privileges. The sources do not say whether the attacker needs more than a standard logon.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","netbios"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local user gains elevated system privileges on the Windows machine.","analyst_note":"Find the affected Windows builds and the Microsoft advisory for CVE-2026-112798 to confirm fixed versions and whether NetBIOS must be enabled.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines with the NetBIOS component in use are the systems to look at, and the attacker must already be authorized on the machine. The sources do not say which Windows versions or configurations are affected, so unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":4480,"output_tokens":433,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and the Microsoft advisory for CVE-2026-112798 to confirm fixed versions and whether NetBIOS must be enabled.","search":"'-112798':16A,19A '-2026':15A,18A 'account':44B 'allow':68C 'alreadi':40B 'attack':38B,55B,71C 'author':70C 'compon':35B 'cve':14A,17A 'elev':73C 'flaw':27B 'free':6A,30B,64C 'gain':11A 'handl':26B 'higher':12A 'infrastructur':20B 'let':7A,36B 'local':9A,43B,75C 'logon':61B 'memori':25B 'memory-handl':24B 'need':56B 'netbio':2A,21B,34B,67C 'privileg':13A,47B,74C 'rais':45B 'say':52B 'sourc':49B 'standard':60B 'use':4A,28B,62C 'use-after-fre':3A 'user':10A 'whether':53B 'window':1A,22B,33B,66C","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the NetBIOS component in use are the systems to look at, and the attacker must already be authorized on the machine. The sources do not say which Windows versions or configurations are affected, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","netbios","windows"],"campaign_type":null,"search_a":"'-112798':16A,19A '-2026':15A,18A 'cve':14A,17A 'free':6A 'gain':11A 'higher':12A 'let':7A 'local':9A 'netbio':2A 'privileg':13A 'use':4A 'use-after-fre':3A 'user':10A 'window':1A","search_b":"'account':44B 'alreadi':40B 'attack':38B,55B 'compon':35B 'flaw':27B 'free':30B 'handl':26B 'infrastructur':20B 'let':36B 'local':43B 'logon':61B 'memori':25B 'memory-handl':24B 'need':56B 'netbio':21B,34B 'privileg':47B 'rais':45B 'say':52B 'sourc':49B 'standard':60B 'use':28B 'whether':53B 'window':22B,33B","search_c":"'allow':68C 'attack':71C 'author':70C 'elev':73C 'free':64C 'local':75C 'netbio':67C 'privileg':74C 'use':62C 'window':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112798","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112798","severity":null,"published_at":"2026-11-10T19:18:41+00:00","modified_at":"2026-11-10T19:18:42+00:00","first_seen_at":"2026-11-10T19:24:33+00:00","fetched_at":"2026-11-10T19:24:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}