{"id":"CVE-2026-113760","kind":"vulnerability","aliases":["CVE-2026-113760"],"related":[],"title":"Windows XWizard Framework: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows XWizard Framework allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows XWizard Framework lets an authorized local user escalate privileges. An attacker who already has a logon on the machine can gain higher rights than they were given.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows XWizard Framework","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":">= 10.0.26100.0, < 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":">= 10.0.26200.0, < 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":">= 10.0.26300.0, < 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":">= 10.0.28000.0, < 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">= 10.0.22631.0, < 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":">= 10.0.19044.0, < 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":">= 10.0.14393.0, < 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":">= 10.0.20348.0, < 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local-users","privilege-escalation","windows","windows-server"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":"Run winver or [System.Environment]::OSVersion in PowerShell and compare the full build (10.0.x.y) with the fixed build for your version. Below the fixed build means exposed.","fix":"Install the November 2026 Windows cumulative update that moves the build to at least the fixed build for your version (e.g. Windows 11 24H2 10.0.26100.9974, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822). KB numbers not confirmed; check the MSRC entry.","status":"open","published_at":"2026-11-10T19:18:54+00:00","first_seen_at":"2026-11-10T19:24:40+00:00","triaged_at":"2026-11-10T19:31:48+00:00","updated_at":"2026-11-10T23:56:18+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:31:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows XWizard Framework: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows XWizard Framework lets an authorized local user escalate privileges. An attacker who already has a logon on the machine can gain higher rights than they were given.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","local-users"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-113760 for affected Windows builds and the patch; NVD alone gives no version or fix.","how_to_check":"unknown","plain_action":"","product_name":"Windows XWizard Framework","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Affects Windows systems running the XWizard Framework component, where a logged-in user with ordinary access can trigger the overflow locally. The sources do not list affected Windows builds or whether the component is enabled by default, so unknown. Systems with no untrusted local users carry lower practical risk.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":4496,"output_tokens":487,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-113760 for affected Windows builds and the patch; NVD alone gives no version or fix.","search":"'-113760':15A,18A '-2026':14A,17A '10':38A,41A,44A,49A '11':23A,26A,29A,32A,35A '1607':50A '1809':45A '2016':52A '2019':47A '2022':55A '2025':58A '21h2':42A '22h2':39A '23h2':36A '24h2':24A '25h2':27A '26h1':33A '26h2':30A 'allow':115C 'alreadi':91B 'attack':89B,118C 'author':83B,117C 'base':73B,108C 'buffer':74B,109C 'cve':13A,16A 'elev':120C 'escal':65B,86B 'framework':3A,21A,80B,114C 'gain':10A,99B 'given':105B 'heap':4A,72B,107C 'heap-bas':71B,106C 'higher':11A,100B 'infrastructur':59B 'let':6A,81B 'local':8A,61B,84B,122C 'local-us':60B 'logon':94B 'machin':97B 'overflow':5A,75B,110C 'privileg':12A,64B,87B,121C 'privilege-escal':63B 'right':101B 'server':46A,51A,54A,57A,69B 'user':9A,62B,85B 'window':1A,66B,68B,78B,112C 'windows':19A,22A,25A,28A,31A,34A,37A,40A,43A,48A,53A,56A 'windows-serv':67B 'xwizard':2A,20A,79B,113C","nicknames":[],"mitigations":[],"who_affected":"Affects Windows systems running the XWizard Framework component, where a logged-in user with ordinary access can trigger the overflow locally. The sources do not list affected Windows builds or whether the component is enabled by default, so unknown. Systems with no untrusted local users carry lower practical risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025","windowsxwizardframework","xwizardframework"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","framework","server","windows","xwizard"],"labels":["high","infrastructure","localusers","privilegeescalation","vendor","windows","windowsserver"],"campaign_type":null,"search_a":"'-113760':15A,18A '-2026':14A,17A '10':38A,41A,44A,49A '11':23A,26A,29A,32A,35A '1607':50A '1809':45A '2016':52A '2019':47A '2022':55A '2025':58A '21h2':42A '22h2':39A '23h2':36A '24h2':24A '25h2':27A '26h1':33A '26h2':30A 'cve':13A,16A 'framework':3A,21A 'gain':10A 'heap':4A 'higher':11A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'server':46A,51A,54A,57A 'user':9A 'window':1A 'windows':19A,22A,25A,28A,31A,34A,37A,40A,43A,48A,53A,56A 'xwizard':2A,20A","search_b":"'alreadi':91B 'attack':89B 'author':83B 'base':73B 'buffer':74B 'escal':65B,86B 'framework':80B 'gain':99B 'given':105B 'heap':72B 'heap-bas':71B 'higher':100B 'infrastructur':59B 'let':81B 'local':61B,84B 'local-us':60B 'logon':94B 'machin':97B 'overflow':75B 'privileg':64B,87B 'privilege-escal':63B 'right':101B 'server':69B 'user':62B,85B 'window':66B,68B,78B 'windows-serv':67B 'xwizard':79B","search_c":"'allow':115C 'attack':118C 'author':117C 'base':108C 'buffer':109C 'elev':120C 'framework':114C 'heap':107C 'heap-bas':106C 'local':122C 'overflow':110C 'privileg':121C 'window':112C 'xwizard':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113760","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113760","severity":null,"published_at":"2026-11-10T19:18:54+00:00","modified_at":"2026-11-10T19:18:54+00:00","first_seen_at":"2026-11-10T19:24:40+00:00","fetched_at":"2026-11-10T19:24:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113760:3254","url":"https://nvd.nist.gov/vuln/detail/cve-2026-113760","severity":null,"published_at":"2026-11-10T23:56:18+00:00","modified_at":"2026-11-10T23:56:18+00:00","first_seen_at":"2026-11-10T23:56:18+00:00","fetched_at":"2026-11-10T23:56:18+00:00","note":"MSRC page is JS-only and unreadable here; builds taken from Microsoft CNA data as mirrored on NVD. KB numbers unknown. Nothing verified. No exploitation or PoC seen (Rapid7: not in KEV).","cites":["https://nvd.nist.gov/vuln/detail/cve-2026-113760"]}],"documents":[{"id":120485,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-113760","title":"NVD: CVE-2026-113760 (Microsoft CNA affected builds)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}