{"id":"CVE-2026-113844","kind":"vulnerability","aliases":["CVE-2026-113844"],"related":[],"title":"Windows NTFS: access control flaw lets a local user tamper with files","description":"Improper access control in Windows NTFS allows an authorized attacker to perform tampering locally.","summary":"Windows NTFS has an improper access control flaw that lets an attacker who already has an account on the machine tamper with data. The NVD record gives a CVSS score of 5.5 (medium) and gives no further detail.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","ntfs","windows"],"not_affected_if":[],"how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update guide entry for CVE-2026-113844\n- Confirm whether Windows Update has applied the monthly cumulative update for your release","fix":null,"status":"open","published_at":"2026-11-10T19:19:05+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","triaged_at":"2026-11-10T20:02:00+00:00","updated_at":"2026-11-10T20:02:00+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:02:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows NTFS: access control flaw lets a local user tamper with files","impact":"medium","summary":"Windows NTFS has an improper access control flaw that lets an attacker who already has an account on the machine tamper with data. The NVD record gives a CVSS score of 5.5 (medium) and gives no further detail.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","ntfs"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user modifies data they should not be able to change","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-113844 to get affected Windows builds and the fixed update.","how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update guide entry for CVE-2026-113844\n- Confirm whether Windows Update has applied the monthly cumulative update for your release","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown. The sources only state that an authorized local attacker can tamper with data through NTFS access control. Systems with many local user accounts or shared Windows hosts are the most relevant to check.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4477,"output_tokens":475,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113844':15A,18A '-2026':14A,17A '5.5':53B 'access':3A,27B,61C 'account':38B 'allow':66C 'alreadi':35B 'attack':33B,69C 'author':68C 'control':4A,28B,62C 'cve':13A,16A 'cvss':50B 'data':44B 'detail':59B 'file':12A 'flaw':5A,29B 'give':48B,56B 'improp':26B,60C 'infrastructur':19B 'let':6A,31B 'local':8A,73C 'machin':41B 'medium':54B 'ntfs':2A,20B,23B,65C 'nvd':46B 'perform':71C 'record':47B 'score':51B 'tamper':10A,42B,72C 'user':9A 'window':1A,21B,22B,64C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","medium","ntfs","windows"],"campaign_type":null,"search_a":"'-113844':15A,18A '-2026':14A,17A 'access':3A 'control':4A 'cve':13A,16A 'file':12A 'flaw':5A 'let':6A 'local':8A 'ntfs':2A 'tamper':10A 'user':9A 'window':1A","search_b":"'5.5':53B 'access':27B 'account':38B 'alreadi':35B 'attack':33B 'control':28B 'cvss':50B 'data':44B 'detail':59B 'flaw':29B 'give':48B,56B 'improp':26B 'infrastructur':19B 'let':31B 'machin':41B 'medium':54B 'ntfs':20B,23B 'nvd':46B 'record':47B 'score':51B 'tamper':42B 'window':21B,22B","search_c":"'access':61C 'allow':66C 'attack':69C 'author':68C 'control':62C 'improp':60C 'local':73C 'ntfs':65C 'perform':71C 'tamper':72C 'window':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113844","severity":null,"published_at":"2026-11-10T19:19:05+00:00","modified_at":"2026-11-10T19:19:05+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","fetched_at":"2026-11-10T19:24:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}