{"id":"CVE-2026-112804","kind":"vulnerability","aliases":["CVE-2026-112804"],"related":[],"title":"Windows exFAT driver heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows exFAT File System allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows exFAT file system driver lets an attacker who already has an account on the machine raise their privileges. The sources do not describe a remote trigger.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["exfat","infrastructure","windows"],"not_affected_if":[],"how_to_check":"- Confirm the Windows build with `winver` and compare it against the Microsoft security update guide entry for CVE-2026-112804","fix":null,"status":"open","published_at":"2026-11-10T19:18:43+00:00","first_seen_at":"2026-11-10T19:24:34+00:00","triaged_at":"2026-11-10T19:53:35+00:00","updated_at":"2026-11-10T19:53:35+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:53:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows exFAT driver heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows exFAT file system driver lets an attacker who already has an account on the machine raise their privileges. The sources do not describe a remote trigger.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["windows","exfat"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local user gains system-level privileges on the Windows machine.","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-112804 for affected builds and the patch, since the sources here give only the NVD description.","how_to_check":"- Confirm the Windows build with `winver` and compare it against the Microsoft security update guide entry for CVE-2026-112804\n- unknown for other checks: the sources do not say which Windows versions or exFAT conditions are affected","plain_action":"Install the latest Windows security update from Settings > Windows Update once Microsoft publishes a fix for this flaw.","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown. The sources describe a local attacker who is already authorized on the machine, which suggests shared or multi-user Windows systems are the most relevant; the sources do not say which Windows builds are affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000713,"input_tokens":4494,"output_tokens":528,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-112804 for affected builds and the patch, since the sources here give only the NVD description.","search":"'-112804':15A,18A '-2026':14A,17A 'account':42B 'allow':67C 'alreadi':39B 'attack':37B,70C 'author':69C 'base':25B,59C 'buffer':26B,60C 'cve':13A,16A 'describ':53B 'driver':3A,34B 'elev':72C 'exfat':2A,19B,31B,64C 'file':32B,65C 'gain':10A 'heap':4A,24B,58C 'heap-bas':23B,57C 'higher':11A 'infrastructur':20B 'let':6A,35B 'local':8A,74C 'machin':45B 'overflow':5A,27B,61C 'privileg':12A,48B,73C 'rais':46B 'remot':55B 'sourc':50B 'system':33B,66C 'trigger':56B 'user':9A 'window':1A,21B,30B,63C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["exfat","high","infrastructure","windows"],"campaign_type":null,"search_a":"'-112804':15A,18A '-2026':14A,17A 'cve':13A,16A 'driver':3A 'exfat':2A 'gain':10A 'heap':4A 'higher':11A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'user':9A 'window':1A","search_b":"'account':42B 'alreadi':39B 'attack':37B 'base':25B 'buffer':26B 'describ':53B 'driver':34B 'exfat':19B,31B 'file':32B 'heap':24B 'heap-bas':23B 'infrastructur':20B 'let':35B 'machin':45B 'overflow':27B 'privileg':48B 'rais':46B 'remot':55B 'sourc':50B 'system':33B 'trigger':56B 'window':21B,30B","search_c":"'allow':67C 'attack':70C 'author':69C 'base':59C 'buffer':60C 'elev':72C 'exfat':64C 'file':65C 'heap':58C 'heap-bas':57C 'local':74C 'overflow':61C 'privileg':73C 'system':66C 'window':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112804","severity":null,"published_at":"2026-11-10T19:18:43+00:00","modified_at":"2026-11-10T19:18:43+00:00","first_seen_at":"2026-11-10T19:24:34+00:00","fetched_at":"2026-11-10T19:24:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}