{"id":"CVE-2026-113820","kind":"vulnerability","aliases":["CVE-2026-113820"],"related":[],"title":"Windows: use-after-free in device management lets a local user gain privileges","description":"Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.","summary":"Windows Modern Device Management (MDM) has a use-after-free memory flaw. An authorized local attacker can use it to elevate their privileges on the machine.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Modern Device Management (MDM)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 11 24H2/25H2/26H2","fixed":["10.0.26100.9974","10.0.26200.9974","10.0.26300.9974"],"affected":"< 10.0.26100.9974 (24H2), < 10.0.26200.9974 (25H2), < 10.0.26300.9974 (26H2)","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 10","fixed":["10.0.17763.9487","10.0.19044.7846","10.0.19045.7846"],"affected":"1809 < 10.0.17763.9487; 21H2 < 10.0.19044.7846; 22H2 < 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows Server","fixed":["10.0.17763.9487","10.0.20348.5870","10.0.26100.33822"],"affected":"2019 < 10.0.17763.9487; 2022 < 10.0.20348.5870; 2025 < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","intune","local-privilege-escalation","mdm","windows","windows-server"],"not_affected_if":["non-windows","not-mdm-enrolled","patched-build"],"how_to_check":"Run winver (or PowerShell: [System.Environment]::OSVersion.Version) and compare the full build number with the fixed builds: Win10 1809/Server 2019 < 10.0.17763.9487; Win10 21H2 < 10.0.19044.7846; Win10 22H2 < 10.0.19045.7846; Win11 23H2 < 10.0.22631.7711; Win11 24H2 < 10.0.26100.9974; Win11 25H2 < 10.0.26200.9974; Win11 26H1 < 10.0.28000.3501; Win11 26H2 < 10.0.26300.9974; Server 2022 < 10.0.20348.5870; Server 2025 < 10.0.26100.33822. Microsoft's listing does not say MDM enrolment is required, so check build number on all devices.","fix":"Install the November 2026 Windows cumulative update that brings the build to at least the fixed number for your version (see how-to-check). KB number not confirmed.","status":"open","published_at":"2026-11-10T19:19:02+00:00","first_seen_at":"2026-11-10T19:24:41+00:00","triaged_at":"2026-11-10T19:52:13+00:00","updated_at":"2026-11-10T23:51:20+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:52:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: use-after-free in device management lets a local user gain privileges","impact":"high","summary":"Windows Modern Device Management (MDM) has a use-after-free memory flaw. An authorized local attacker can use it to elevate their privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","mdm","intune"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher system privileges on the machine","analyst_note":"Find the affected Windows builds and the Microsoft patch in the MSRC entry for CVE-2026-113820 (https://nvd.nist.gov/vuln/detail/CVE-2026-113820).","how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update guide entry for CVE-2026-113820\n- Confirm whether the device is enrolled in MDM (Settings > Accounts > Access work or school)","plain_action":"","product_name":"Windows Modern Device Management (MDM)","needs_analyst":true,"not_affected_if":["not-mdm-enrolled","non-windows"],"who_is_affected":"Only machines running Windows with MDM enrollment are described; the attacker must already be authorized on the machine. The sources do not list affected Windows builds. Systems not enrolled in MDM are unlikely to be exposed, but the sources do not confirm this.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4492,"output_tokens":565,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and the Microsoft patch in the MSRC entry for CVE-2026-113820 (https://nvd.nist.gov/vuln/detail/CVE-2026-113820).","search":"'-113820':17A,20A '-2026':16A,19A '10':36A '11':27A,30A,33A '23h2':31A '24h2/25h2/26h2':28A '26h1':34A 'allow':86C 'attack':66B,89C 'author':64B,88C 'cve':15A,18A 'devic':7A,52B,83C 'device':23A 'elev':71B,91C 'escal':44B 'flaw':62B 'free':5A,60B,79C 'gain':13A 'infrastructur':39B 'intun':40B 'let':9A 'local':11A,42B,65B,93C 'local-privilege-escal':41B 'machin':76B 'manag':8A,53B,84C 'management':24A 'mdm':25A,45B,54B,85C 'memori':61B 'modern':22A,51B,82C 'privileg':14A,43B,73B,92C 'server':38A,49B 'use':3A,58B,68B,77C 'use-after-fre':2A,57B 'user':12A 'window':1A,46B,48B,50B,81C 'windows':21A,26A,29A,32A,35A,37A 'windows-serv':47B","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10, Windows 11 or Windows Server 2019/2022/2025 machine below the fixed build is listed as affected by Microsoft. An attacker needs an account on the machine (local, low privilege) and can then use a use-after-free in Modern Device Management to gain higher privileges (CVSS 7.0, high attack complexity). Shared machines, terminals and servers with many local users matter most; fully patched machines can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["10","1123h2","1124h225h226h2","1126h1","moderndevicemanagementmdm","server","windows10","windows1123h2","windows1124h225h226h2","windows1126h1","windowsmoderndevicemanagementmdm","windowsserver"],"ptokens":["10","11","23h2","24h2","25h2","26h1","26h2","device","management","mdm","modern","server","windows"],"labels":["high","infrastructure","intune","localprivilegeescalation","mdm","vendor","windows","windowsserver"],"campaign_type":null,"search_a":"'-113820':17A,20A '-2026':16A,19A '10':36A '11':27A,30A,33A '23h2':31A '24h2/25h2/26h2':28A '26h1':34A 'cve':15A,18A 'devic':7A 'device':23A 'free':5A 'gain':13A 'let':9A 'local':11A 'manag':8A 'management':24A 'mdm':25A 'modern':22A 'privileg':14A 'server':38A 'use':3A 'use-after-fre':2A 'user':12A 'window':1A 'windows':21A,26A,29A,32A,35A,37A","search_b":"'attack':66B 'author':64B 'devic':52B 'elev':71B 'escal':44B 'flaw':62B 'free':60B 'infrastructur':39B 'intun':40B 'local':42B,65B 'local-privilege-escal':41B 'machin':76B 'manag':53B 'mdm':45B,54B 'memori':61B 'modern':51B 'privileg':43B,73B 'server':49B 'use':58B,68B 'use-after-fre':57B 'window':46B,48B,50B 'windows-serv':47B","search_c":"'allow':86C 'attack':89C 'author':88C 'devic':83C 'elev':91C 'free':79C 'local':93C 'manag':84C 'mdm':85C 'modern':82C 'privileg':92C 'use':77C 'window':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113820","severity":null,"published_at":"2026-11-10T19:19:02+00:00","modified_at":"2026-11-10T19:19:02+00:00","first_seen_at":"2026-11-10T19:24:41+00:00","fetched_at":"2026-11-10T19:24:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113820:3244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113820","severity":null,"published_at":"2026-11-10T23:51:20+00:00","modified_at":"2026-11-10T23:51:20+00:00","first_seen_at":"2026-11-10T23:51:20+00:00","fetched_at":"2026-11-10T23:51:20+00:00","note":"Affected builds and fixed build numbers from Microsoft CNA data mirrored on NVD; MSRC page is JS-only and did not render, so nothing marked verified. KB numbers unknown. No exploitation or PoC seen; did not search social.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-113820"]}],"documents":[{"id":120470,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113820","title":"NVD CVE-2026-113820 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}