{"id":"CVE-2026-113848","kind":"vulnerability","aliases":["CVE-2026-113848"],"related":[],"title":"Windows NTFS: null pointer flaw lets a local attacker run code","description":"Null pointer dereference in Windows NTFS allows an unauthorized attacker to execute code locally.","summary":"A null pointer dereference in the Windows NTFS file system driver lets an attacker who can already run code on the machine execute code with higher privileges. Sources report a CVSS score of 7.8 and no known exploitation.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","local","ntfs","windows"],"not_affected_if":["no-local-access","patched"],"how_to_check":"Run winver or [Environment]::OSVersion in PowerShell and compare the build number with the fixed builds listed in the fix. A build below the fixed one for your Windows version is exposed. Confirm on the MSRC page for this CVE.","fix":"Install the November 2026 (10 Nov) Windows cumulative update. Per Microsoft's CVE record, fixed builds: Win10 1607/Server 2016 10.0.14393.9688; Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822.","status":"open","published_at":"2026-11-10T19:19:05+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","triaged_at":"2026-11-10T19:40:54+00:00","updated_at":"2026-11-10T23:49:34+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:40:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows NTFS: null pointer flaw lets a local attacker run code","impact":"high","summary":"A null pointer dereference in the Windows NTFS file system driver lets an attacker who can already run code on the machine execute code with higher privileges. Sources report a CVSS score of 7.8 and no known exploitation.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","ntfs"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker runs code with elevated privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-113848 for affected Windows builds, the patch, and any mitigation.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-access"],"who_is_affected":"Any Windows machine with NTFS volumes is in scope, since NTFS is the default Windows file system. The attacker needs local access to the machine first, so exposure depends on who can log on or run code there. The sources do not name affected Windows versions or builds.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000673,"input_tokens":4482,"output_tokens":449,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-113848 for affected Windows builds, the patch, and any mitigation.","search":"'-113848':14A,17A '-2026':13A,16A '10':19A,24A,29A,32A '11':35A,38A,41A,44A,47A '1607':20A '1809':25A '2016':22A '2019':27A '2022':51A '2025':54A '21h2':30A '22h2':33A '23h2':36A '24h2':39A '25h2':42A '26h1':45A '26h2':48A '7.8':92B 'allow':103C 'alreadi':75B 'attack':9A,72B,106C 'code':11A,77B,82B,109C 'cve':12A,15A 'cvss':89B 'derefer':62B,99C 'driver':69B 'execut':81B,108C 'exploit':96B 'file':67B 'flaw':5A 'higher':84B 'infrastructur':55B 'known':95B 'let':6A,70B 'local':8A,56B,110C 'machin':80B 'ntfs':2A,57B,66B,102C 'null':3A,60B,97C 'pointer':4A,61B,98C 'privileg':85B 'report':87B 'run':10A,76B 'score':90B 'server':21A,26A,50A,53A 'sourc':86B 'system':68B 'unauthor':105C 'window':1A,58B,65B,101C 'windows':18A,23A,28A,31A,34A,37A,40A,43A,46A,49A,52A","nicknames":[],"mitigations":[],"who_affected":"Windows 10, Windows 11 and Windows Server 2016 to 2025 below the fixed builds are listed as affected in Microsoft's CVE record. The attacker needs local access, and the CVSS vector says a user must take an action (UI:R). Hosts where untrusted users or code can run, such as shared servers, RDS or CI runners, matter most. Fully patched machines can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","local","ntfs","windows"],"campaign_type":null,"search_a":"'-113848':14A,17A '-2026':13A,16A '10':19A,24A,29A,32A '11':35A,38A,41A,44A,47A '1607':20A '1809':25A '2016':22A '2019':27A '2022':51A '2025':54A '21h2':30A '22h2':33A '23h2':36A '24h2':39A '25h2':42A '26h1':45A '26h2':48A 'attack':9A 'code':11A 'cve':12A,15A 'flaw':5A 'let':6A 'local':8A 'ntfs':2A 'null':3A 'pointer':4A 'run':10A 'server':21A,26A,50A,53A 'window':1A 'windows':18A,23A,28A,31A,34A,37A,40A,43A,46A,49A,52A","search_b":"'7.8':92B 'alreadi':75B 'attack':72B 'code':77B,82B 'cvss':89B 'derefer':62B 'driver':69B 'execut':81B 'exploit':96B 'file':67B 'higher':84B 'infrastructur':55B 'known':95B 'let':70B 'local':56B 'machin':80B 'ntfs':57B,66B 'null':60B 'pointer':61B 'privileg':85B 'report':87B 'run':76B 'score':90B 'sourc':86B 'system':68B 'window':58B,65B","search_c":"'allow':103C 'attack':106C 'code':109C 'derefer':99C 'execut':108C 'local':110C 'ntfs':102C 'null':97C 'pointer':98C 'unauthor':105C 'window':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113848","severity":null,"published_at":"2026-11-10T19:19:05+00:00","modified_at":"2026-11-10T19:19:06+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","fetched_at":"2026-11-10T19:24:42+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113848:3238","url":"https://app.opencve.io/cve/CVE-2026-113848","severity":null,"published_at":"2026-11-10T23:49:34+00:00","modified_at":"2026-11-10T23:49:34+00:00","first_seen_at":"2026-11-10T23:49:34+00:00","fetched_at":"2026-11-10T23:49:34+00:00","note":"MSRC page is JS-only and unreadable; build data comes from OpenCVE mirror of Microsoft's CNA record (not primary read), so nothing marked verified. Patched in Nov 2026 Patch Tuesday; no exploitation reported (E:U). Microsoft titles it 'Remote Code Execution' but vector is local, UI required.","cites":["https://app.opencve.io/cve/CVE-2026-113848","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-113848"]}],"documents":[{"id":120465,"url":"https://app.opencve.io/cve/CVE-2026-113848","title":"OpenCVE: CVE-2026-113848 (mirror of Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120466,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-113848","title":"MSRC Security Update Guide: CVE-2026-113848 (JS-only, not readable)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}