---
id: "CVE-2026-113768"
page: "https://infrastack.ai/live/CVE-2026-113768"
kind: "vulnerability"
aliases: ["CVE-2026-113768"]
title: "Windows Performance Counters: heap overflow lets remote attacker run code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:18:56+00:00"
first_seen_at: "2026-11-10T19:24:40+00:00"
updated_at: "2026-11-10T19:45:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113768", "first_seen_at": "2026-11-10T19:24:40+00:00"}]
exploit_sources: []
---

# Windows Performance Counters: heap overflow lets remote attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-113768 (this .md is for agents)

A heap-based buffer overflow in the Windows Performance Counters service lets an unauthorized attacker run code over the network. The sources give no further detail on the trigger or the affected Windows builds.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T19:24:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113768

## From the sources

Heap-based buffer overflow in Windows Performance Counters allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_