{"id":"CVE-2026-113765","kind":"vulnerability","aliases":["CVE-2026-113765"],"related":[],"title":"Windows File Server Resource Management: heap overflow lets a local user gain privileges","description":"Heap-based buffer overflow in Windows File Server Resource Management Service allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows File Server Resource Management Service lets an authorized local user raise their privileges. Exploitation requires that the attacker already has a valid account on the machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows File Server Resource Management Service","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["file-server","infrastructure","windows","windows-server"],"not_affected_if":["fsrm-not-installed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:55+00:00","first_seen_at":"2026-11-10T19:24:40+00:00","triaged_at":"2026-11-10T19:40:58+00:00","updated_at":"2026-11-10T19:40:58+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:40:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows File Server Resource Management: heap overflow lets a local user gain privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows File Server Resource Management Service lets an authorized local user raise their privileges. Exploitation requires that the attacker already has a valid account on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-server","file-server"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows server","analyst_note":"Check Microsoft's security update guide for CVE-2026-113765 to find affected Windows builds, the fixed update, and how to check whether FSRM is installed.","how_to_check":"- unknown","plain_action":"","product_name":"Windows File Server Resource Management Service","needs_analyst":true,"not_affected_if":["fsrm-not-installed"],"who_is_affected":"Windows Servers running the File Server Resource Management service (FSRM, part of the File Server role) are the systems to look at. The sources do not say which Windows builds or configurations are affected, and the attacker must already be authorized on the machine. Systems without the FSRM role installed are likely not exposed, but the sources do not confirm this.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000705,"input_tokens":4495,"output_tokens":512,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check Microsoft's security update guide for CVE-2026-113765 to find affected Windows builds, the fixed update, and how to check whether FSRM is installed.","search":"'-113765':16A,19A '-2026':15A,18A 'account':65B 'allow':81C 'alreadi':61B 'attack':60B,84C 'author':50B,83C 'base':37B,71C 'buffer':38B,72C 'cve':14A,17A 'elev':86C 'exploit':56B 'file':2A,21A,27B,43B,76C 'file-serv':26B 'gain':12A 'heap':6A,36B,70C 'heap-bas':35B,69C 'infrastructur':29B 'let':8A,48B 'local':10A,51B,88C 'machin':68B 'manag':5A,46B,79C 'management':24A 'overflow':7A,39B,73C 'privileg':13A,55B,87C 'rais':53B 'requir':57B 'resourc':4A,45B,78C 'resource':23A 'server':3A,22A,28B,33B,44B,77C 'servic':47B,80C 'service':25A 'user':11A,52B 'valid':64B 'window':1A,30B,32B,42B,75C 'windows':20A 'windows-serv':31B","nicknames":[],"mitigations":[],"who_affected":"Windows Servers running the File Server Resource Management service (FSRM, part of the File Server role) are the systems to look at. The sources do not say which Windows builds or configurations are affected, and the attacker must already be authorized on the machine. Systems without the FSRM role installed are likely not exposed, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["fileserverresourcemanagementservice","windowsfileserverresourcemanagementservice"],"ptokens":["file","management","resource","server","service","windows"],"labels":["fileserver","high","infrastructure","vendor","windows","windowsserver"],"campaign_type":null,"search_a":"'-113765':16A,19A '-2026':15A,18A 'cve':14A,17A 'file':2A,21A 'gain':12A 'heap':6A 'let':8A 'local':10A 'manag':5A 'management':24A 'overflow':7A 'privileg':13A 'resourc':4A 'resource':23A 'server':3A,22A 'service':25A 'user':11A 'window':1A 'windows':20A","search_b":"'account':65B 'alreadi':61B 'attack':60B 'author':50B 'base':37B 'buffer':38B 'exploit':56B 'file':27B,43B 'file-serv':26B 'heap':36B 'heap-bas':35B 'infrastructur':29B 'let':48B 'local':51B 'machin':68B 'manag':46B 'overflow':39B 'privileg':55B 'rais':53B 'requir':57B 'resourc':45B 'server':28B,33B,44B 'servic':47B 'user':52B 'valid':64B 'window':30B,32B,42B 'windows-serv':31B","search_c":"'allow':81C 'attack':84C 'author':83C 'base':71C 'buffer':72C 'elev':86C 'file':76C 'heap':70C 'heap-bas':69C 'local':88C 'manag':79C 'overflow':73C 'privileg':87C 'resourc':78C 'server':77C 'servic':80C 'window':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113765","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113765","severity":null,"published_at":"2026-11-10T19:18:55+00:00","modified_at":"2026-11-10T19:18:55+00:00","first_seen_at":"2026-11-10T19:24:40+00:00","fetched_at":"2026-11-10T19:24:40+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}