WEBSAM WINSHARE · CVE-2026-113364 · Vendor
NO FIX YET
NEC WebSAM WinShare on Windows has a buffer overflow in its data receiving process, triggered by a crafted packet with a malformed data size in the protocol header. A remote attacker with no login can run arbitrary code with SYSTEM privileges.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organisations running NEC WebSAM WinShare on Windows, versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2, are exposed. Any host where the data receiving service accepts network packets is in scope. Systems running other versions or without WinShare installed can skip it.
Not affected if not-installed, unsupported-version-not-listed
Who cares nec-websam, windows, winshare
7.5.0 and earlier, 7.6.0, or 7.7.0 through 7.7.2 are in use.No fix yet, per the sources.
Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.