{"id":"CVE-2026-113748","kind":"vulnerability","aliases":["CVE-2026-113748"],"related":[],"title":"Software Protection Platform: stack overflow lets a local user gain higher privileges","description":"Stack-based buffer overflow in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.","summary":"A stack-based buffer overflow in Microsoft's Software Protection Platform (SPP) lets an authorized local user raise their privileges. An attacker who already has a foothold on the machine can gain elevated rights.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","software-protection-platform","windows"],"not_affected_if":["no-local-accounts"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:52+00:00","first_seen_at":"2026-11-10T19:24:37+00:00","triaged_at":"2026-11-10T19:41:03+00:00","updated_at":"2026-11-10T19:41:03+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:41:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Software Protection Platform: stack overflow lets a local user gain higher privileges","impact":"high","summary":"A stack-based buffer overflow in Microsoft's Software Protection Platform (SPP) lets an authorized local user raise their privileges. An attacker who already has a foothold on the machine can gain elevated rights.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","software-protection-platform"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Find the vendor advisory and affected versions and fixed builds for CVE-2026-113748 in the NVD entry or Microsoft's Security Update Guide.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-accounts"],"who_is_affected":"Only users who already have an account on the affected machine can use this flaw, since it is a local privilege escalation. The sources do not name affected versions or the exact configuration, so teams should confirm against the vendor advisory. Systems where many people hold local logins are the ones to look at first.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":4498,"output_tokens":462,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the vendor advisory and affected versions and fixed builds for CVE-2026-113748 in the NVD entry or Microsoft's Security Update Guide.","search":"'-113748':15A,18A '-2026':14A,17A 'allow':70C 'alreadi':49B 'attack':47B,73C 'author':40B,72C 'base':28B,62C 'buffer':29B,63C 'cve':13A,16A 'elev':58B,75C 'foothold':52B 'gain':10A,57B 'higher':11A 'infrastructur':19B 'let':6A,38B 'local':8A,41B,77C 'machin':55B 'microsoft':32B 'overflow':5A,30B,64C 'platform':3A,23B,36B,68C 'privileg':12A,45B,76C 'protect':2A,22B,35B,67C 'rais':43B 'right':59B 'softwar':1A,21B,34B,66C 'software-protection-platform':20B 'spp':37B,69C 'stack':4A,27B,61C 'stack-bas':26B,60C 'user':9A,42B 'window':24B","nicknames":[],"mitigations":[],"who_affected":"Only users who already have an account on the affected machine can use this flaw, since it is a local privilege escalation. The sources do not name affected versions or the exact configuration, so teams should confirm against the vendor advisory. Systems where many people hold local logins are the ones to look at first.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","softwareprotectionplatform","windows"],"campaign_type":null,"search_a":"'-113748':15A,18A '-2026':14A,17A 'cve':13A,16A 'gain':10A 'higher':11A 'let':6A 'local':8A 'overflow':5A 'platform':3A 'privileg':12A 'protect':2A 'softwar':1A 'stack':4A 'user':9A","search_b":"'alreadi':49B 'attack':47B 'author':40B 'base':28B 'buffer':29B 'elev':58B 'foothold':52B 'gain':57B 'infrastructur':19B 'let':38B 'local':41B 'machin':55B 'microsoft':32B 'overflow':30B 'platform':23B,36B 'privileg':45B 'protect':22B,35B 'rais':43B 'right':59B 'softwar':21B,34B 'software-protection-platform':20B 'spp':37B 'stack':27B 'stack-bas':26B 'user':42B 'window':24B","search_c":"'allow':70C 'attack':73C 'author':72C 'base':62C 'buffer':63C 'elev':75C 'local':77C 'overflow':64C 'platform':68C 'privileg':76C 'protect':67C 'softwar':66C 'spp':69C 'stack':61C 'stack-bas':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113748","severity":null,"published_at":"2026-11-10T19:18:52+00:00","modified_at":"2026-11-10T19:18:52+00:00","first_seen_at":"2026-11-10T19:24:37+00:00","fetched_at":"2026-11-10T19:24:37+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}