{"id":"CVE-2026-113859","kind":"vulnerability","aliases":["CVE-2026-113859"],"related":[],"title":"Windows TCP/IP: use-after-free lets adjacent attacker run code","description":"Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network.","summary":"Use-after-free in the Windows TCP/IP stack. An unauthenticated attacker on the same network segment (adjacent, high attack complexity) can execute code. Microsoft rates it CVSS 7.5. Fixed in the November 2026 Patch Tuesday updates. No exploitation reported in the sources I read.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":">= 10.0.26100.0, < 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":">= 10.0.26200.0, < 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":">= 10.0.28000.0, < 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":">= 10.0.26300.0, < 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["adjacent-network","infrastructure","tcp-ip","windows","windows-11","windows-server-2025"],"not_affected_if":["patched"],"how_to_check":"Run winver or [System.Environment]::OSVersion in PowerShell and compare the build with the fixed builds: below 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.26300.9974 (26H2), 10.0.28000.3501 (26H1), or 10.0.26100.33822 (Server 2025, incl. Server Core) means exposed. Also check Windows 10/Server 2022/2019 against the Security Update Guide entry; the CNA list shows only the Windows 11 and Server 2025 rows.","fix":"Install the November 2026 cumulative update: Windows 11 24H2/25H2/26H2 KB5132061 (builds 26100.9974 / 26200.9974 / 26300.9974); Windows 11 26H1 KB5132059 (28000.3501); Windows Server 2025 KB5131080 (26100.33822). KB numbers come from press coverage; confirm in the Security Update Guide.","status":"open","published_at":"2026-11-10T19:19:06+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","triaged_at":"2026-11-10T19:45:02+00:00","updated_at":"2026-11-10T23:48:15+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:45:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows TCP/IP: use-after-free lets adjacent attacker run code","impact":"high","summary":"A memory bug in the Windows TCP/IP networking stack lets an attacker on the same local network segment trigger a use-after-free. The sources say this can lead to code execution without any account.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","tcp-ip"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"code runs on the Windows host via the network stack","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-113859 for affected Windows builds, fixed updates and any mitigation; the NVD record alone gives no versions.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines reachable from an adjacent network segment are the systems to look at. The sources do not name affected Windows builds or configurations, so whether a given machine is exposed is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":4488,"output_tokens":422,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-113859 for affected Windows builds, fixed updates and any mitigation; the NVD record alone gives no versions.","search":"'-11':42B '-113859':14A,17A '-2026':13A,16A '11':19A,22A,25A,28A '2025':32A,46B '2026':80B '24h2':20A '25h2':23A '26h1':26A '26h2':29A '7.5':75B 'adjac':8A,34B,64B,107C 'adjacent-network':33B 'allow':98C 'attack':9A,58B,66B,101C 'code':11A,70B,104C 'complex':67B 'cve':12A,15A 'cvss':74B 'execut':69B,103C 'exploit':85B 'fix':76B 'free':6A,50B,94C 'high':65B 'infrastructur':36B 'ip':39B 'let':7A 'microsoft':71B 'network':35B,62B,108C 'novemb':79B 'patch':81B 'rate':72B 'read':91B 'report':86B 'run':10A 'segment':63B 'server':31A,45B 'sourc':89B 'stack':55B 'tcp':38B 'tcp-ip':37B 'tcp/ip':2A,54B,97C 'tuesday':82B 'unauthent':57B 'unauthor':100C 'updat':83B 'use':4A,48B,92C 'use-after-fre':3A,47B 'window':1A,40B,41B,44B,53B,96C 'windows':18A,21A,24A,27A,30A 'windows-serv':43B","nicknames":[],"mitigations":[],"who_affected":"Windows 11 24H2, 25H2, 26H1 and 26H2 and Windows Server 2025 (including Server Core) on builds older than the November 2026 update. The attacker must be on the same local network segment (same LAN, Wi-Fi or VLAN), so shared offices, public Wi-Fi and flat server networks matter most; systems not reachable by untrusted adjacent hosts are lower priority.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Install the November 2026 Windows update: Settings > Windows Update > Check for updates, then restart.","pkeys":["1124h2","1125h2","1126h1","1126h2","server2025","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2025"],"ptokens":["11","2025","24h2","25h2","26h1","26h2","server","windows"],"labels":["adjacentnetwork","high","infrastructure","tcpip","windows","windows11","windowsserver2025"],"campaign_type":null,"search_a":"'-113859':14A,17A '-2026':13A,16A '11':19A,22A,25A,28A '2025':32A '24h2':20A '25h2':23A '26h1':26A '26h2':29A 'adjac':8A 'attack':9A 'code':11A 'cve':12A,15A 'free':6A 'let':7A 'run':10A 'server':31A 'tcp/ip':2A 'use':4A 'use-after-fre':3A 'window':1A 'windows':18A,21A,24A,27A,30A","search_b":"'-11':42B '2025':46B '2026':80B '7.5':75B 'adjac':34B,64B 'adjacent-network':33B 'attack':58B,66B 'code':70B 'complex':67B 'cvss':74B 'execut':69B 'exploit':85B 'fix':76B 'free':50B 'high':65B 'infrastructur':36B 'ip':39B 'microsoft':71B 'network':35B,62B 'novemb':79B 'patch':81B 'rate':72B 'read':91B 'report':86B 'segment':63B 'server':45B 'sourc':89B 'stack':55B 'tcp':38B 'tcp-ip':37B 'tcp/ip':54B 'tuesday':82B 'unauthent':57B 'updat':83B 'use':48B 'use-after-fre':47B 'window':40B,41B,44B,53B 'windows-serv':43B","search_c":"'adjac':107C 'allow':98C 'attack':101C 'code':104C 'execut':103C 'free':94C 'network':108C 'tcp/ip':97C 'unauthor':100C 'use':92C 'window':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113859","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113859","severity":null,"published_at":"2026-11-10T19:19:06+00:00","modified_at":"2026-11-10T19:19:06+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","fetched_at":"2026-11-10T19:24:42+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113859:3235","url":"https://nvd.nist.gov/vuln/detail/cve-2026-113859","severity":null,"published_at":"2026-11-10T23:48:15+00:00","modified_at":"2026-11-10T23:48:15+00:00","first_seen_at":"2026-11-10T23:48:15+00:00","fetched_at":"2026-11-10T23:48:15+00:00","note":"MSRC page is JS-only and unreadable here; affected builds taken from NVD record carrying Microsoft's CNA data; KB numbers from Patch Tuesday coverage (windowsreport). Nothing marked verified. No exploitation or PoC found; Microsoft's CVSS 7.5 (AV:A/AC:H). No mitigation found.","cites":["https://nvd.nist.gov/vuln/detail/cve-2026-113859","https://windowsreport.com/windows-11-kb5132061-kb5131087-kb5132059-november-2026-patch-tuesday-updates-out-now/"]}],"documents":[{"id":120452,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-113859","title":"NVD CVE-2026-113859 (CNA data from Microsoft)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118020,"url":"https://windowsreport.com/windows-11-kb5132061-kb5131087-kb5132059-november-2026-patch-tuesday-updates-out-now/","title":"Windows 11 KB5132061, KB5132059 November 2026 updates","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}