{"id":"CVE-2026-113817","kind":"vulnerability","aliases":["CVE-2026-113817"],"related":[],"title":"Windows HID driver heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Devices Human Interface allows an authorized attacker to elevate privileges with a physical attack.","summary":"A heap-based buffer overflow in the Windows Devices Human Interface component lets an authorized attacker raise their privileges. The description says the attack is physical, so it needs access to the device.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows"],"not_affected_if":["no-physical-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:19:01+00:00","first_seen_at":"2026-11-10T19:24:41+00:00","triaged_at":"2026-11-10T19:56:03+00:00","updated_at":"2026-11-10T19:56:03+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:56:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows HID driver heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Devices Human Interface component lets an authorized attacker raise their privileges. The description says the attack is physical, so it needs access to the device.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker with local account gains elevated system privileges","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-113817 for affected Windows builds, the patch, and whether the attack needs a specific USB or HID device.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-physical-access"],"who_is_affected":"Windows machines with the Human Interface Devices component; the sources do not name affected builds or say which devices are needed. The attacker must already be authorized on the machine and have physical access.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000667,"input_tokens":4502,"output_tokens":434,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113817':15A,18A '-2026':14A,17A 'access':51B 'allow':65C 'attack':37B,45B,68C,75C 'author':36B,67C 'base':24B,57C 'buffer':25B,58C 'compon':33B 'cve':13A,16A 'descript':42B 'devic':30B,54B,62C 'driver':3A 'elev':70C 'gain':10A 'heap':4A,23B,56C 'heap-bas':22B,55C 'hid':2A 'higher':11A 'human':31B,63C 'infrastructur':19B 'interfac':32B,64C 'let':6A,34B 'local':8A 'need':50B 'overflow':5A,26B,59C 'physic':47B,74C 'privileg':12A,40B,71C 'rais':38B 'say':43B 'user':9A 'window':1A,20B,29B,61C","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the Human Interface Devices component; the sources do not name affected builds or say which devices are needed. The attacker must already be authorized on the machine and have physical access.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","medium","windows"],"campaign_type":null,"search_a":"'-113817':15A,18A '-2026':14A,17A 'cve':13A,16A 'driver':3A 'gain':10A 'heap':4A 'hid':2A 'higher':11A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'user':9A 'window':1A","search_b":"'access':51B 'attack':37B,45B 'author':36B 'base':24B 'buffer':25B 'compon':33B 'descript':42B 'devic':30B,54B 'heap':23B 'heap-bas':22B 'human':31B 'infrastructur':19B 'interfac':32B 'let':34B 'need':50B 'overflow':26B 'physic':47B 'privileg':40B 'rais':38B 'say':43B 'window':20B,29B","search_c":"'allow':65C 'attack':68C,75C 'author':67C 'base':57C 'buffer':58C 'devic':62C 'elev':70C 'heap':56C 'heap-bas':55C 'human':63C 'interfac':64C 'overflow':59C 'physic':74C 'privileg':71C 'window':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113817","severity":null,"published_at":"2026-11-10T19:19:01+00:00","modified_at":"2026-11-10T19:19:01+00:00","first_seen_at":"2026-11-10T19:24:41+00:00","fetched_at":"2026-11-10T19:24:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}