{"id":"CVE-2026-112987","kind":"vulnerability","aliases":["CVE-2026-112987"],"related":[],"title":"Windows MDM: integer overflow lets an authorized user gain local privileges","description":"Integer overflow or wraparound in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.","summary":"Windows Modern Device Management has an integer overflow or wraparound flaw. An attacker who already holds an authorized account on the machine can raise their privileges locally.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Modern Device Management","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["endpoint-management","infrastructure","mdm","windows"],"not_affected_if":["no-mdm-enrollment"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:51+00:00","first_seen_at":"2026-11-10T19:24:37+00:00","triaged_at":"2026-11-10T19:53:27+00:00","updated_at":"2026-11-10T19:53:27+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:53:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows MDM: integer overflow lets an authorized user gain local privileges","impact":"high","summary":"Windows Modern Device Management has an integer overflow or wraparound flaw. An attacker who already holds an authorized account on the machine can raise their privileges locally.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","mdm","endpoint-management"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Find Microsoft's CVE-2026-112987 advisory for affected Windows builds, the patched KB or build numbers, and whether MDM must be enabled for exposure.","how_to_check":"unknown","plain_action":"","product_name":"Windows Modern Device Management","needs_analyst":true,"not_affected_if":["no-mdm-enrollment"],"who_is_affected":"Windows machines enrolled in or using Modern Device Management (MDM) are the likely exposure, since the flaw sits in that component. The sources do not name affected Windows builds or the exact enrollment conditions. Systems not using MDM are probably not exposed, but the sources do not confirm this.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000696,"input_tokens":4502,"output_tokens":492,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find Microsoft's CVE-2026-112987 advisory for affected Windows builds, the patched KB or build numbers, and whether MDM must be enabled for exposure.","search":"'-112987':14A,17A '-2026':13A,16A 'account':46B 'allow':65C 'alreadi':42B 'attack':40B,68C 'author':7A,45B,67C 'cve':12A,15A 'devic':30B,62C 'device':20A 'elev':70C 'endpoint':23B 'endpoint-manag':22B 'flaw':38B 'gain':9A 'hold':43B 'infrastructur':25B 'integ':3A,34B,55C 'let':5A 'local':10A,54B,72C 'machin':49B 'manag':24B,31B,63C 'management':21A 'mdm':2A,26B,64C 'modern':19A,29B,61C 'overflow':4A,35B,56C 'privileg':11A,53B,71C 'rais':51B 'user':8A 'window':1A,27B,28B,60C 'windows':18A 'wraparound':37B,58C","nicknames":[],"mitigations":[],"who_affected":"Windows machines enrolled in or using Modern Device Management (MDM) are the likely exposure, since the flaw sits in that component. The sources do not name affected Windows builds or the exact enrollment conditions. Systems not using MDM are probably not exposed, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["moderndevicemanagement","windowsmoderndevicemanagement"],"ptokens":["device","management","modern","windows"],"labels":["endpointmanagement","high","infrastructure","mdm","vendor","windows"],"campaign_type":null,"search_a":"'-112987':14A,17A '-2026':13A,16A 'author':7A 'cve':12A,15A 'device':20A 'gain':9A 'integ':3A 'let':5A 'local':10A 'management':21A 'mdm':2A 'modern':19A 'overflow':4A 'privileg':11A 'user':8A 'window':1A 'windows':18A","search_b":"'account':46B 'alreadi':42B 'attack':40B 'author':45B 'devic':30B 'endpoint':23B 'endpoint-manag':22B 'flaw':38B 'hold':43B 'infrastructur':25B 'integ':34B 'local':54B 'machin':49B 'manag':24B,31B 'mdm':26B 'modern':29B 'overflow':35B 'privileg':53B 'rais':51B 'window':27B,28B 'wraparound':37B","search_c":"'allow':65C 'attack':68C 'author':67C 'devic':62C 'elev':70C 'integ':55C 'local':72C 'manag':63C 'mdm':64C 'modern':61C 'overflow':56C 'privileg':71C 'window':60C 'wraparound':58C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112987","severity":null,"published_at":"2026-11-10T19:18:51+00:00","modified_at":"2026-11-10T19:18:51+00:00","first_seen_at":"2026-11-10T19:24:37+00:00","fetched_at":"2026-11-10T19:24:37+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}