{"id":"CVE-2026-113847","kind":"vulnerability","aliases":["CVE-2026-113847"],"related":[],"title":"Windows Installer: integer overflow lets a local user gain higher privileges","description":"Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Windows Installer has an integer overflow or wraparound bug that lets an attacker who already has a local account raise their privileges. The attacker gets higher rights on the same machine than they were granted.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows","windows-installer"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":"Unknown until Microsoft's affected builds and KBs are read. Check that the November 2026 Windows cumulative update is installed (winver, Get-HotFix) and compare with the MSRC page for CVE-2026-113847.","fix":null,"status":"open","published_at":"2026-11-10T19:19:05+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","triaged_at":"2026-11-10T19:40:57+00:00","updated_at":"2026-11-10T23:49:04+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:40:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Installer: integer overflow lets a local user gain higher privileges","impact":"high","summary":"Windows Installer has an integer overflow or wraparound bug that lets an attacker who already has a local account raise their privileges. The attacker gets higher rights on the same machine than they were granted.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-installer"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains elevated privileges on the machine","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds, fixed versions and any published patch for CVE-2026-113847.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines where users hold a local account and Windows Installer is present; the sources do not say which Windows builds are affected or which configurations are exposed. Systems where every user is fully trusted and no untrusted local accounts exist carry less practical risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000664,"input_tokens":4488,"output_tokens":431,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds, fixed versions and any published patch for CVE-2026-113847.","search":"'-113847':14A,17A '-2026':13A,16A 'account':45B 'allow':69C 'alreadi':41B 'attack':39B,50B,72C 'author':71C 'bug':35B 'cve':12A,15A 'elev':74C 'escal':22B 'gain':9A 'get':51B 'grant':61B 'higher':10A,52B 'infrastructur':18B 'instal':2A,26B,28B,68C 'integ':3A,31B,62C 'let':5A,37B 'local':7A,20B,44B,76C 'local-privilege-escal':19B 'machin':57B 'overflow':4A,32B,63C 'privileg':11A,21B,48B,75C 'rais':46B 'right':53B 'user':8A 'window':1A,23B,25B,27B,67C 'windows-instal':24B 'wraparound':34B,65C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where users hold a local account and Windows Installer is present; the sources do not say which Windows builds are affected or which configurations are exposed. Systems where every user is fully trusted and no untrusted local accounts exist carry less practical risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","windows","windowsinstaller"],"campaign_type":null,"search_a":"'-113847':14A,17A '-2026':13A,16A 'cve':12A,15A 'gain':9A 'higher':10A 'instal':2A 'integ':3A 'let':5A 'local':7A 'overflow':4A 'privileg':11A 'user':8A 'window':1A","search_b":"'account':45B 'alreadi':41B 'attack':39B,50B 'bug':35B 'escal':22B 'get':51B 'grant':61B 'higher':52B 'infrastructur':18B 'instal':26B,28B 'integ':31B 'let':37B 'local':20B,44B 'local-privilege-escal':19B 'machin':57B 'overflow':32B 'privileg':21B,48B 'rais':46B 'right':53B 'window':23B,25B,27B 'windows-instal':24B 'wraparound':34B","search_c":"'allow':69C 'attack':72C 'author':71C 'elev':74C 'instal':68C 'integ':62C 'local':76C 'overflow':63C 'privileg':75C 'window':67C 'wraparound':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113847","severity":null,"published_at":"2026-11-10T19:19:05+00:00","modified_at":"2026-11-10T19:19:05+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","fetched_at":"2026-11-10T19:24:42+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113847:3239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113847","severity":null,"published_at":"2026-11-10T23:49:04+00:00","modified_at":"2026-11-10T23:49:04+00:00","first_seen_at":"2026-11-10T23:49:04+00:00","fetched_at":"2026-11-10T23:49:04+00:00","note":"Only NVD entry linked (CVSS 7.8, AV:L/PR:L, CNA secure@microsoft.com). MSRC update guide page is JavaScript-only and returned no content; affected builds, KB numbers and fixes unknown. Settle by reading the MSRC page in a browser or the Nov 2026 Patch Tuesday CVRF. No exploitation or PoC seen; nothing verified.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-113847"]}],"documents":[{"id":120460,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113847","title":"NVD CVE-2026-113847","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}