{"id":"CVE-2026-113842","kind":"vulnerability","aliases":["CVE-2026-113842"],"related":[],"title":"Windows Security Center: use-after-free lets a local user gain higher privileges (Windows 10 and 11)","description":"Use after free in Windows Security Center allows an authorized attacker to elevate privileges locally.","summary":"A memory bug in Windows Security Center lets a user who already has local access run code with higher privileges. An attacker needs an authorized local account first.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1809","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local-accounts","privilege-escalation","windows"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":"Run winver or PowerShell [System.Environment]::OSVersion.Version / (Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').UBR and compare the full build (10.0.<build>.<UBR>) with the fixed build for your release; lower means exposed.","fix":"Install the November 2026 Windows cumulative update that brings your build to at least: Win10 1809 10.0.17763.9487, 21H2 10.0.19044.7846, 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711, 24H2 10.0.26100.9974, 25H2 10.0.26200.9974, 26H1 10.0.28000.3501, 26H2 10.0.26300.9974. KB number not confirmed; see the MSRC page.","status":"open","published_at":"2026-11-10T19:19:05+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","triaged_at":"2026-11-10T19:52:11+00:00","updated_at":"2026-11-10T23:51:33+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:52:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Security Center: use-after-free lets local user gain higher privileges","impact":"high","summary":"A memory bug in Windows Security Center lets a user who already has local access run code with higher privileges. An attacker needs an authorized local account first.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["windows","local-accounts"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the machine","analyst_note":"Find the Microsoft advisory for CVE-2026-113842 to confirm affected Windows builds, the fixed update, and how to check for it.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Security Center","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Windows machines where a local user account is used, including shared computers and systems with multiple accounts. The sources do not name affected Windows builds or a fixed update. Machines with only a single trusted user are lower risk.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":4476,"output_tokens":436,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-113842 to confirm affected Windows builds, the fixed update, and how to check for it.","search":"'-113842':21A,24A '-2026':20A,23A '10':16A,26A,29A,32A '11':18A,35A,38A,41A,44A,47A '1809':27A '21h2':30A '22h2':33A '23h2':36A '24h2':39A '25h2':42A '26h1':45A '26h2':48A 'access':71B 'account':52B,83B 'allow':92C 'alreadi':68B 'attack':78B,95C 'author':81B,94C 'bug':59B 'center':3A,63B,91C 'code':73B 'cve':19A,22A 'elev':97C 'escal':55B 'first':84B 'free':7A,87C 'gain':12A 'higher':13A,75B 'infrastructur':49B 'let':8A,64B 'local':10A,51B,70B,82B,99C 'local-account':50B 'memori':58B 'need':79B 'privileg':14A,54B,76B,98C 'privilege-escal':53B 'run':72B 'secur':2A,62B,90C 'use':5A,85C 'use-after-fre':4A 'user':11A,66B 'window':1A,15A,56B,61B,89C 'windows':25A,28A,31A,34A,37A,40A,43A,46A","nicknames":[],"mitigations":[],"who_affected":"Windows 10 (1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) machines below the fixed builds. An attacker needs an existing local account and the attack is rated high complexity. Single-user machines with no untrusted local users or services running as low-privileged accounts are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Install the latest Windows updates: Settings > Windows Update > Check for updates.","pkeys":["101809","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","windows101809","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2"],"ptokens":["10","11","1809","21h2","22h2","23h2","24h2","25h2","26h1","26h2","windows"],"labels":["high","infrastructure","localaccounts","privilegeescalation","vendor","windows"],"campaign_type":null,"search_a":"'-113842':21A,24A '-2026':20A,23A '10':16A,26A,29A,32A '11':18A,35A,38A,41A,44A,47A '1809':27A '21h2':30A '22h2':33A '23h2':36A '24h2':39A '25h2':42A '26h1':45A '26h2':48A 'center':3A 'cve':19A,22A 'free':7A 'gain':12A 'higher':13A 'let':8A 'local':10A 'privileg':14A 'secur':2A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A,15A 'windows':25A,28A,31A,34A,37A,40A,43A,46A","search_b":"'access':71B 'account':52B,83B 'alreadi':68B 'attack':78B 'author':81B 'bug':59B 'center':63B 'code':73B 'escal':55B 'first':84B 'higher':75B 'infrastructur':49B 'let':64B 'local':51B,70B,82B 'local-account':50B 'memori':58B 'need':79B 'privileg':54B,76B 'privilege-escal':53B 'run':72B 'secur':62B 'user':66B 'window':56B,61B","search_c":"'allow':92C 'attack':95C 'author':94C 'center':91C 'elev':97C 'free':87C 'local':99C 'privileg':98C 'secur':90C 'use':85C 'window':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113842","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113842","severity":null,"published_at":"2026-11-10T19:19:05+00:00","modified_at":"2026-11-10T19:19:05+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","fetched_at":"2026-11-10T19:24:42+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113842:3241","url":"https://nvd.nist.gov/vuln/detail/cve-2026-113842","severity":null,"published_at":"2026-11-10T23:51:33+00:00","modified_at":"2026-11-10T23:51:33+00:00","first_seen_at":"2026-11-10T23:51:33+00:00","fetched_at":"2026-11-10T23:51:33+00:00","note":"MSRC page is JS-only and unreadable here; build ranges taken from Microsoft CNA record as shown on NVD/OpenCVE. KB numbers unknown; nothing marked verified. No exploitation or PoC seen.","cites":["https://nvd.nist.gov/vuln/detail/cve-2026-113842","https://app.opencve.io/cve/CVE-2026-113842"]}],"documents":[{"id":120473,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-113842","title":"NVD CVE-2026-113842 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":120475,"url":"https://app.opencve.io/cve/CVE-2026-113842","title":"OpenCVE CVE-2026-113842 affected builds","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}