{"id":"CVE-2026-112812","kind":"vulnerability","aliases":["CVE-2026-112812"],"related":[],"title":"Windows SMB Client: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in the Windows SMB Client lets an attacker who already has an authorized local account run code with elevated privileges. NVD rates it high (CVSS 7.0); the sources give no more detail.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","smb","windows"],"not_affected_if":["no-local-logon"],"how_to_check":"unknown: Microsoft's affected-build list is not readable yet. Check the Security Update Guide entry for CVE-2026-112812 and compare your Windows build with the listed KB.","fix":null,"status":"open","published_at":"2026-11-10T19:18:45+00:00","first_seen_at":"2026-11-10T19:24:34+00:00","triaged_at":"2026-11-10T19:53:31+00:00","updated_at":"2026-11-11T00:03:54+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:53:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows SMB Client: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in the Windows SMB Client lets an attacker who already has an authorized local account run code with elevated privileges. NVD rates it high (CVSS 7.0); the sources give no more detail.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","smb"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows machine","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-112812 to get affected Windows builds, the fixed update and any mitigation.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-logon"],"who_is_affected":"Windows machines that use the SMB Client are the systems in scope, and the attacker must already be able to log on or run code locally. The sources do not say which Windows versions are affected or what configuration is needed. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":4478,"output_tokens":432,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-112812 to get affected Windows builds, the fixed update and any mitigation.","search":"'-112812':17A,20A '-2026':16A,19A '7.0':55B 'account':44B 'allow':69C 'alreadi':39B 'attack':37B,72C 'author':42B,71C 'bug':29B 'client':3A,34B,68C 'code':46B 'cve':15A,18A 'cvss':54B 'detail':61B 'elev':48B,74C 'free':7A,28B,64C 'gain':12A 'give':58B 'high':53B 'higher':13A 'infrastructur':21B 'let':8A,35B 'local':10A,43B,76C 'nvd':50B 'privileg':14A,49B,75C 'rate':51B 'run':45B 'smb':2A,22B,33B,67C 'sourc':57B 'use':5A,26B,62C 'use-after-fre':4A,25B 'user':11A 'window':1A,23B,32B,66C","nicknames":[],"mitigations":[],"who_affected":"Windows machines that use the SMB Client are the systems in scope, and the attacker must already be able to log on or run code locally. The sources do not say which Windows versions are affected or what configuration is needed. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","smb","windows"],"campaign_type":null,"search_a":"'-112812':17A,20A '-2026':16A,19A 'client':3A 'cve':15A,18A 'free':7A 'gain':12A 'higher':13A 'let':8A 'local':10A 'privileg':14A 'smb':2A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A","search_b":"'7.0':55B 'account':44B 'alreadi':39B 'attack':37B 'author':42B 'bug':29B 'client':34B 'code':46B 'cvss':54B 'detail':61B 'elev':48B 'free':28B 'give':58B 'high':53B 'infrastructur':21B 'let':35B 'local':43B 'nvd':50B 'privileg':49B 'rate':51B 'run':45B 'smb':22B,33B 'sourc':57B 'use':26B 'use-after-fre':25B 'window':23B,32B","search_c":"'allow':69C 'attack':72C 'author':71C 'client':68C 'elev':74C 'free':64C 'local':76C 'privileg':75C 'smb':67C 'use':62C 'window':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112812","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112812","severity":null,"published_at":"2026-11-10T19:18:45+00:00","modified_at":"2026-11-10T19:18:46+00:00","first_seen_at":"2026-11-10T19:24:34+00:00","fetched_at":"2026-11-10T19:24:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112812:3277","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112812","severity":null,"published_at":"2026-11-11T00:03:54+00:00","modified_at":"2026-11-11T00:03:54+00:00","first_seen_at":"2026-11-11T00:03:54+00:00","fetched_at":"2026-11-11T00:03:54+00:00","note":"MSRC Update Guide page is JS-only (returned empty shell), browser-cli unavailable (plan limit), no search hits for this id. Only NVD (CVSS 7.0, AV:L/AC:H/PR:L, Microsoft as CNA) read. Affected builds, KB and mitigation unknown; revisit once Microsoft's entry or a Patch Tuesday write-up is indexed. Nothing verified. Similar SMB bugs (CVE-2026-88127 Server UAF, Oct 2026) are separate.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-112812"]}],"documents":[{"id":120512,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112812","title":"NVD: CVE-2026-112812","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}