{"id":"CVE-2026-112972","kind":"vulnerability","aliases":["CVE-2026-112972"],"related":[],"title":"Windows SMB Server: integer overflow lets an authorized user run code remotely","description":"Integer overflow or wraparound in Windows SMB Server allows an authorized attacker to execute code over a network.","summary":"A flaw in the Windows SMB Server file-sharing service is an integer overflow that can cause memory corruption. An attacker with valid access to the network can run code on the affected machine.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-sharing","infrastructure","smb","windows"],"not_affected_if":["smb-server-disabled"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:47+00:00","first_seen_at":"2026-11-10T19:24:35+00:00","triaged_at":"2026-11-10T19:45:09+00:00","updated_at":"2026-11-10T19:45:09+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:45:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows SMB Server: integer overflow lets an authorized user run code remotely","impact":"high","summary":"A flaw in the Windows SMB Server file-sharing service is an integer overflow that can cause memory corruption. An attacker with valid access to the network can run code on the affected machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","smb","file-sharing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the server with the attacker's network access","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-112972 for affected Windows builds and the patch name.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["smb-server-disabled"],"who_is_affected":"Systems running the Windows SMB Server service, which is used for file and printer sharing, can be affected. The sources do not say which Windows versions or configurations are vulnerable, so unknown. Machines that do not run the SMB server role are unlikely to be exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000667,"input_tokens":4488,"output_tokens":436,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-112972 for affected Windows builds and the patch name.","search":"'-112972':15A,18A '-2026':14A,17A 'access':49B 'affect':58B 'allow':68C 'attack':46B,71C 'author':8A,70C 'caus':42B 'code':11A,55B,74C 'corrupt':44B 'cve':13A,16A 'execut':73C 'file':20B,33B 'file-shar':19B,32B 'flaw':26B 'infrastructur':22B 'integ':4A,38B,60C 'let':6A 'machin':59B 'memori':43B 'network':52B,77C 'overflow':5A,39B,61C 'remot':12A 'run':10A,54B 'server':3A,31B,67C 'servic':35B 'share':21B,34B 'smb':2A,23B,30B,66C 'user':9A 'valid':48B 'window':1A,24B,29B,65C 'wraparound':63C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Windows SMB Server service, which is used for file and printer sharing, can be affected. The sources do not say which Windows versions or configurations are vulnerable, so unknown. Machines that do not run the SMB server role are unlikely to be exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["filesharing","high","infrastructure","smb","windows"],"campaign_type":null,"search_a":"'-112972':15A,18A '-2026':14A,17A 'author':8A 'code':11A 'cve':13A,16A 'integ':4A 'let':6A 'overflow':5A 'remot':12A 'run':10A 'server':3A 'smb':2A 'user':9A 'window':1A","search_b":"'access':49B 'affect':58B 'attack':46B 'caus':42B 'code':55B 'corrupt':44B 'file':20B,33B 'file-shar':19B,32B 'flaw':26B 'infrastructur':22B 'integ':38B 'machin':59B 'memori':43B 'network':52B 'overflow':39B 'run':54B 'server':31B 'servic':35B 'share':21B,34B 'smb':23B,30B 'valid':48B 'window':24B,29B","search_c":"'allow':68C 'attack':71C 'author':70C 'code':74C 'execut':73C 'integ':60C 'network':77C 'overflow':61C 'server':67C 'smb':66C 'window':65C 'wraparound':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112972","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112972","severity":null,"published_at":"2026-11-10T19:18:47+00:00","modified_at":"2026-11-10T19:18:48+00:00","first_seen_at":"2026-11-10T19:24:35+00:00","fetched_at":"2026-11-10T19:24:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}