{"id":"CVE-2026-113856","kind":"vulnerability","aliases":["CVE-2026-113856"],"related":[],"title":"Windows Hyper-V: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","summary":"Windows Hyper-V elevation-of-privilege flaw (heap-based buffer overflow per triage sources) fixed in Microsoft's November 2026 Patch Tuesday. An authorized local attacker can gain higher privileges; on shared Hyper-V hosts that can affect workloads on the host. No exploitation reported; the only exploited bug that month was an Outlook flaw. Exact affected builds and KB numbers were not confirmed from Microsoft's page.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hyper-v","infrastructure","privilege-escalation","self-hosted","windows"],"not_affected_if":["hyper-v-not-enabled"],"how_to_check":"Check whether the machine runs the Hyper-V role or hosts VMs (Get-WindowsFeature Hyper-V on servers, or Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V on clients), then confirm the November 2026 (2026-11) cumulative update is installed (Get-HotFix). Look up the exact KB for your Windows version on the MSRC page for CVE-2026-113856; not confirmed here.","fix":"Install the November 2026 Windows security update (released 2026-11-10) on Hyper-V hosts. Exact KB per Windows version unknown; see the MSRC Security Update Guide entry for CVE-2026-113856.","status":"open","published_at":"2026-11-10T19:19:06+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","triaged_at":"2026-11-10T19:40:54+00:00","updated_at":"2026-11-10T23:48:14+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:40:54Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Windows Hyper-V: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in Windows Hyper-V lets an authorized local attacker elevate their privileges. The sources give a CVSS score of 7.8 and say nothing about exploitation in the wild.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","hyper-v","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher privileges on the Hyper-V host","analyst_note":"Confirm affected Windows and Hyper-V builds and the fixed update from the Microsoft security advisory for CVE-2026-113856.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["hyper-v-not-enabled"],"who_is_affected":"Hosts running Windows with the Hyper-V role enabled are the systems to look at. The sources do not say which Windows builds are affected, so the exposure is unknown. Machines without Hyper-V can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":4494,"output_tokens":449,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Windows and Hyper-V builds and the fixed update from the Microsoft security advisory for CVE-2026-113856.","search":"'-113856':16A,19A '-2026':15A,18A '2026':53B 'affect':72B,91B 'allow':113C 'attack':59B,116C 'author':57B,115C 'base':42B,105C 'buffer':43B,106C 'bug':83B 'build':92B 'confirm':98B 'cve':14A,17A 'elev':36B,118C 'elevation-of-privileg':35B 'escal':26B 'exact':90B 'exploit':78B,82B 'fix':48B 'flaw':39B,89B 'gain':11A,61B 'heap':5A,41B,104C 'heap-bas':40B,103C 'higher':12A,62B 'host':29B,69B,76B 'hyper':3A,21B,33B,67B,111C 'hyper-v':2A,20B,32B,66B,110C 'infrastructur':23B 'kb':94B 'let':7A 'local':9A,58B,120C 'microsoft':50B,100B 'month':85B 'novemb':52B 'number':95B 'outlook':88B 'overflow':6A,44B,107C 'page':102B 'patch':54B 'per':45B 'privileg':13A,25B,38B,63B,119C 'privilege-escal':24B 'report':79B 'self':28B 'self-host':27B 'share':65B 'sourc':47B 'triag':46B 'tuesday':55B 'user':10A 'v':4A,22B,34B,68B,112C 'window':1A,30B,31B,109C 'workload':73B","nicknames":[],"mitigations":[],"who_affected":"Hosts running Windows with the Hyper-V role enabled are the systems to look at. The sources do not say which Windows builds are affected, so the exposure is unknown. Machines without Hyper-V can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","hyperv","infrastructure","privilegeescalation","selfhosted","windows"],"campaign_type":null,"search_a":"'-113856':16A,19A '-2026':15A,18A 'cve':14A,17A 'gain':11A 'heap':5A 'higher':12A 'hyper':3A 'hyper-v':2A 'let':7A 'local':9A 'overflow':6A 'privileg':13A 'user':10A 'v':4A 'window':1A","search_b":"'2026':53B 'affect':72B,91B 'attack':59B 'author':57B 'base':42B 'buffer':43B 'bug':83B 'build':92B 'confirm':98B 'elev':36B 'elevation-of-privileg':35B 'escal':26B 'exact':90B 'exploit':78B,82B 'fix':48B 'flaw':39B,89B 'gain':61B 'heap':41B 'heap-bas':40B 'higher':62B 'host':29B,69B,76B 'hyper':21B,33B,67B 'hyper-v':20B,32B,66B 'infrastructur':23B 'kb':94B 'local':58B 'microsoft':50B,100B 'month':85B 'novemb':52B 'number':95B 'outlook':88B 'overflow':44B 'page':102B 'patch':54B 'per':45B 'privileg':25B,38B,63B 'privilege-escal':24B 'report':79B 'self':28B 'self-host':27B 'share':65B 'sourc':47B 'triag':46B 'tuesday':55B 'v':22B,34B,68B 'window':30B,31B 'workload':73B","search_c":"'allow':113C 'attack':116C 'author':115C 'base':105C 'buffer':106C 'elev':118C 'heap':104C 'heap-bas':103C 'hyper':111C 'hyper-v':110C 'local':120C 'overflow':107C 'privileg':119C 'v':112C 'window':109C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113856","severity":null,"published_at":"2026-11-10T19:19:06+00:00","modified_at":"2026-11-10T19:19:06+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","fetched_at":"2026-11-10T19:24:42+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113856:3236","url":"https://beyondmachines.net/event_details/microsoft-patches-1235-flaws-in-november-2026-update-including-actively-exploited-outlook-flaw-a-y-v-q-f","severity":null,"published_at":"2026-11-10T23:48:14+00:00","modified_at":"2026-11-10T23:48:14+00:00","first_seen_at":"2026-11-10T23:48:14+00:00","fetched_at":"2026-11-10T23:48:14+00:00","note":"MSRC and NVD pages returned empty via web-cli; only a secondary roundup (BeyondMachines) confirms the CVE is in Microsoft's Nov 10 2026 Patch Tuesday, Hyper-V EoP, rated Critical there, not exploited (only the Outlook CVE-2026-124194 is). Affected builds, KB numbers unverified; nothing marked verified.","cites":["https://beyondmachines.net/event_details/microsoft-patches-1235-flaws-in-november-2026-update-including-actively-exploited-outlook-flaw-a-y-v-q-f"]}],"documents":[{"id":120454,"url":"https://beyondmachines.net/event_details/microsoft-patches-1235-flaws-in-november-2026-update-including-actively-exploited-outlook-flaw-a-y-v-q-f","title":"Microsoft Patches 1,235 Flaws in November 2026 Update (BeyondMachines)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}