---
id: "CVE-2026-112809"
page: "https://infrastack.ai/live/CVE-2026-112809"
kind: "vulnerability"
aliases: ["CVE-2026-112809"]
title: "Windows Composite Image File System: local user can disclose information"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "windows"]
not_affected_if: ["no-local-users"]
published_at: "2026-11-10T19:18:45+00:00"
first_seen_at: "2026-11-10T19:24:34+00:00"
updated_at: "2026-11-10T20:02:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112809", "first_seen_at": "2026-11-10T19:24:34+00:00"}]
exploit_sources: []
---

# Windows Composite Image File System: local user can disclose information

Link for people: https://infrastack.ai/live/CVE-2026-112809 (this .md is for agents)

Windows Composite Image File System has an access control flaw that lets an authorized local user read information they should not see. The attacker needs a local account on the affected machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T19:24:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112809

## From the sources

Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_