{"id":"CVE-2026-113757","kind":"vulnerability","aliases":["CVE-2026-113757"],"related":[],"title":"Windows FileCrypt Driver: access control flaw leaks information to local users","description":"Improper access control in Windows FileCrypt Driver allows an authorized attacker to disclose information locally.","summary":"The Windows FileCrypt Driver has an improper access control flaw. An authorized local attacker can read information they should not be able to see.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows FileCrypt Driver","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:54+00:00","first_seen_at":"2026-11-10T19:24:38+00:00","triaged_at":"2026-11-10T20:02:03+00:00","updated_at":"2026-11-10T20:02:03+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:02:03Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Windows FileCrypt Driver: access control flaw leaks information to local users","impact":"low","summary":"The Windows FileCrypt Driver has an improper access control flaw. An authorized local attacker can read information they should not be able to see.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user reads information they should not access","analyst_note":"Confirm affected Windows builds and the fixed update from the Microsoft advisory for CVE-2026-113757; the NVD entry gives neither.","how_to_check":"- unknown","plain_action":"","product_name":"Windows FileCrypt Driver","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Only authorized local users on a Windows machine can trigger this, according to the NVD description. Remote attackers without local access are not described as affected. The sources do not list affected Windows builds or whether the FileCrypt Driver is enabled by default.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000665,"input_tokens":4485,"output_tokens":432,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113757':14A,17A '-2026':13A,16A 'abl':44B 'access':4A,30B,48C 'allow':54C 'attack':36B,57C 'author':34B,56C 'control':5A,31B,49C 'cve':12A,15A 'disclos':59C 'driver':3A,20A,26B,53C 'filecrypt':2A,19A,25B,52C 'flaw':6A,32B 'improp':29B,47C 'inform':8A,39B,60C 'infrastructur':21B 'leak':7A 'local':10A,35B,61C 'read':38B 'see':46B 'user':11A 'window':1A,22B,24B,51C 'windows':18A","nicknames":[],"mitigations":[],"who_affected":"Only authorized local users on a Windows machine can trigger this, according to the NVD description. Remote attackers without local access are not described as affected. The sources do not list affected Windows builds or whether the FileCrypt Driver is enabled by default.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["filecryptdriver","windowsfilecryptdriver"],"ptokens":["driver","filecrypt","windows"],"labels":["infrastructure","medium","vendor","windows"],"campaign_type":null,"search_a":"'-113757':14A,17A '-2026':13A,16A 'access':4A 'control':5A 'cve':12A,15A 'driver':3A,20A 'filecrypt':2A,19A 'flaw':6A 'inform':8A 'leak':7A 'local':10A 'user':11A 'window':1A 'windows':18A","search_b":"'abl':44B 'access':30B 'attack':36B 'author':34B 'control':31B 'driver':26B 'filecrypt':25B 'flaw':32B 'improp':29B 'inform':39B 'infrastructur':21B 'local':35B 'read':38B 'see':46B 'window':22B,24B","search_c":"'access':48C 'allow':54C 'attack':57C 'author':56C 'control':49C 'disclos':59C 'driver':53C 'filecrypt':52C 'improp':47C 'inform':60C 'local':61C 'window':51C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113757","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113757","severity":null,"published_at":"2026-11-10T19:18:54+00:00","modified_at":"2026-11-10T19:18:54+00:00","first_seen_at":"2026-11-10T19:24:38+00:00","fetched_at":"2026-11-10T19:24:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}