{"id":"CVE-2026-112799","kind":"vulnerability","aliases":["CVE-2026-112799"],"related":[],"title":"Windows Projected File System: stack overflow lets a local user gain admin rights","description":"Stack-based buffer overflow in Windows Projected File System allows an authorized attacker to elevate privileges locally.","summary":"A stack-based buffer overflow in the Windows Projected File System lets a user who already has a local account raise their privileges. The sources give no more detail on the trigger or the affected Windows builds.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","projected-file-system","windows"],"not_affected_if":["feature-disabled","no-local-accounts"],"how_to_check":"- Check the Windows build with `winver` and compare it against the patch list in Microsoft's advisory for CVE-2026-112799.\n- Check whether the Projected File System feature is enabled with `Get-WindowsOptionalFeature -Online -FeatureName Client-ProjFS`.","fix":null,"status":"open","published_at":"2026-11-10T19:18:42+00:00","first_seen_at":"2026-11-10T19:24:33+00:00","triaged_at":"2026-11-10T19:42:12+00:00","updated_at":"2026-11-10T19:42:12+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:42:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Projected File System: stack overflow lets a local user gain admin rights","impact":"high","summary":"A stack-based buffer overflow in the Windows Projected File System lets a user who already has a local account raise their privileges. The sources give no more detail on the trigger or the affected Windows builds.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","projected-file-system"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM privileges on the machine","analyst_note":"Find the affected Windows builds and the patch KB in the Microsoft Security Update Guide entry for CVE-2026-112799; sources give no fix.","how_to_check":"- Check the Windows build with `winver` and compare it against the patch list in Microsoft's advisory for CVE-2026-112799.\n- Check whether the Projected File System feature is enabled with `Get-WindowsOptionalFeature -Online -FeatureName Client-ProjFS`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["feature-disabled","no-local-accounts"],"who_is_affected":"Windows machines with the Projected File System feature in use are the systems to look at, and an attacker needs an authorized local account first. Systems where the feature is absent or disabled are likely not exposed, but the sources do not confirm this. The sources do not name affected builds.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4492,"output_tokens":548,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and the patch KB in the Microsoft Security Update Guide entry for CVE-2026-112799; sources give no fix.","search":"'-112799':16A,19A '-2026':15A,18A 'account':46B 'admin':12A 'affect':61B 'allow':74C 'alreadi':42B 'attack':77C 'author':76C 'base':29B,66C 'buffer':30B,67C 'build':63B 'cve':14A,17A 'detail':55B 'elev':79C 'file':3A,23B,36B,72C 'gain':11A 'give':52B 'infrastructur':20B 'let':7A,38B 'local':9A,45B,81C 'overflow':6A,31B,68C 'privileg':49B,80C 'project':2A,22B,35B,71C 'projected-file-system':21B 'rais':47B 'right':13A 'sourc':51B 'stack':5A,28B,65C 'stack-bas':27B,64C 'system':4A,24B,37B,73C 'trigger':58B 'user':10A,40B 'window':1A,25B,34B,62B,70C","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the Projected File System feature in use are the systems to look at, and an attacker needs an authorized local account first. Systems where the feature is absent or disabled are likely not exposed, but the sources do not confirm this. The sources do not name affected builds.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","projectedfilesystem","windows"],"campaign_type":null,"search_a":"'-112799':16A,19A '-2026':15A,18A 'admin':12A 'cve':14A,17A 'file':3A 'gain':11A 'let':7A 'local':9A 'overflow':6A 'project':2A 'right':13A 'stack':5A 'system':4A 'user':10A 'window':1A","search_b":"'account':46B 'affect':61B 'alreadi':42B 'base':29B 'buffer':30B 'build':63B 'detail':55B 'file':23B,36B 'give':52B 'infrastructur':20B 'let':38B 'local':45B 'overflow':31B 'privileg':49B 'project':22B,35B 'projected-file-system':21B 'rais':47B 'sourc':51B 'stack':28B 'stack-bas':27B 'system':24B,37B 'trigger':58B 'user':40B 'window':25B,34B,62B","search_c":"'allow':74C 'attack':77C 'author':76C 'base':66C 'buffer':67C 'elev':79C 'file':72C 'local':81C 'overflow':68C 'privileg':80C 'project':71C 'stack':65C 'stack-bas':64C 'system':73C 'window':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112799","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112799","severity":null,"published_at":"2026-11-10T19:18:42+00:00","modified_at":"2026-11-10T19:18:42+00:00","first_seen_at":"2026-11-10T19:24:33+00:00","fetched_at":"2026-11-10T19:24:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}