---
id: "CVE-2026-112987"
page: "https://infrastack.ai/live/CVE-2026-112987"
kind: "vulnerability"
aliases: ["CVE-2026-112987"]
title: "Windows MDM: integer overflow lets an authorized user gain local privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Modern Device Management", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": "< 10.0.26100.9974", "ecosystem": "vendor"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9974"], "affected": "< 10.0.26200.9974", "ecosystem": "vendor"}, {"name": "Windows 11 26H2", "fixed": ["10.0.26300.9974"], "affected": "< 10.0.26300.9974", "ecosystem": "vendor"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": "< 10.0.22631.7711", "ecosystem": "vendor"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": "< 10.0.19045.7846", "ecosystem": "vendor"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": "< 10.0.26100.33822", "ecosystem": "vendor"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": "< 10.0.20348.5870", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["endpoint-management", "infrastructure", "local-privilege-escalation", "mdm", "windows", "windows-10", "windows-11", "windows-server"]
not_affected_if: ["no-mdm-enrollment"]
published_at: "2026-11-10T19:18:51+00:00"
first_seen_at: "2026-11-10T19:24:37+00:00"
updated_at: "2026-11-11T00:00:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112987", "first_seen_at": "2026-11-10T19:24:37+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/cve-2026-112987", "first_seen_at": "2026-11-11T00:00:42+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/cve-2026-112987"]}]
exploit_sources: []
---

# Windows MDM: integer overflow lets an authorized user gain local privileges

Link for people: https://infrastack.ai/live/CVE-2026-112987 (this .md is for agents)

Windows Modern Device Management has an integer overflow or wraparound flaw. An attacker who already holds an authorized account on the machine can raise their privileges locally.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Modern Device Management affected range not listed fixed no fixed version listed
- vendor:Windows 11 24H2 affected < 10.0.26100.9974 fixed 10.0.26100.9974
- vendor:Windows 11 25H2 affected < 10.0.26200.9974 fixed 10.0.26200.9974
- vendor:Windows 11 26H2 affected < 10.0.26300.9974 fixed 10.0.26300.9974
- vendor:Windows 11 23H2 affected < 10.0.22631.7711 fixed 10.0.22631.7711
- vendor:Windows 10 22H2 affected < 10.0.19045.7846 fixed 10.0.19045.7846
- vendor:Windows Server 2025 affected < 10.0.26100.33822 fixed 10.0.26100.33822
- vendor:Windows Server 2022 affected < 10.0.20348.5870 fixed 10.0.20348.5870

## How to check

Run winver or [System.Environment]::OSVersion / 'ver' and compare the full build (e.g. 10.0.26100.xxxx) with the fixed build for your Windows version; below it means exposed. Whether MDM enrollment is needed for exposure is not stated by sources.

## Fix

Install the November 2026 Patch Tuesday cumulative update. Fixed builds per NVD (Microsoft CNA): Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822.

## Timeline

- 2026-11-10T19:24:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112987
- 2026-11-11T00:00:42+00:00 analyst https://nvd.nist.gov/vuln/detail/cve-2026-112987 — MSRC page is JS-only and not read; affected builds and fixed builds taken from NVD's copy of Microsoft CNA data (secondary), so nothing marked verified. Exact KB numbers per OS not confirmed. Nov 2026 Patch Tuesday builds match (e.g. Win11 24H2 26100.9974 via KB5132061). No exploitation or PoC found.

## Documents

- [describes] NVD CVE-2026-112987 (Microsoft CNA affected builds) https://nvd.nist.gov/vuln/detail/cve-2026-112987

## From the sources

Integer overflow or wraparound in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_