{"id":"CVE-2026-116706","kind":"vulnerability","aliases":["CVE-2026-116706"],"related":[],"title":"Windows: use-after-free in link-layer discovery lets attackers run code","description":"Use after free in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over an adjacent network.","summary":"A use-after-free bug in the Windows Link Layer Topology Discovery protocol handling lets an unauthorized attacker run code on a machine. The attack travels over an adjacent network segment, so the attacker must be on the same local network.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","network","windows"],"not_affected_if":["isolated-network"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:19:12+00:00","first_seen_at":"2026-11-10T19:24:45+00:00","triaged_at":"2026-11-10T19:44:55+00:00","updated_at":"2026-11-10T19:44:55+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:44:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows: use-after-free in link-layer discovery lets attackers run code","impact":"high","summary":"A use-after-free bug in the Windows Link Layer Topology Discovery protocol handling lets an unauthorized attacker run code on a machine. The attack travels over an adjacent network segment, so the attacker must be on the same local network.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["windows","network"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs on the Windows machine from an adjacent network attacker","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-116706 for affected Windows builds, default state of LLTD and the patch.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["isolated-network"],"who_is_affected":"Windows machines that process Link Layer Topology Discovery traffic on a local network segment are the exposed systems. Machines on networks with no untrusted adjacent devices are at lower practical risk. The sources do not state which Windows versions are affected or whether the feature is on by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":4502,"output_tokens":457,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-116706 for affected Windows builds, default state of LLTD and the patch.","search":"'-116706':17A,20A '-2026':16A,19A 'adjac':53B,85C 'allow':76C 'attack':12A,42B,49B,58B,79C 'bug':29B 'code':14A,44B,82C 'cve':15A,18A 'discoveri':10A,36B,74C 'execut':81C 'free':5A,28B,68C 'handl':38B 'infrastructur':21B 'layer':9A,34B,72C 'let':11A,39B 'link':8A,33B,71C 'link-lay':7A 'local':64B 'machin':47B 'must':59B 'network':22B,54B,65B,86C 'protocol':37B,75C 'run':13A,43B 'segment':55B 'topolog':35B,73C 'travel':50B 'unauthor':41B,78C 'use':3A,26B,66C 'use-after-fre':2A,25B 'window':1A,23B,32B,70C","nicknames":[],"mitigations":[],"who_affected":"Windows machines that process Link Layer Topology Discovery traffic on a local network segment are the exposed systems. Machines on networks with no untrusted adjacent devices are at lower practical risk. The sources do not state which Windows versions are affected or whether the feature is on by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","network","windows"],"campaign_type":null,"search_a":"'-116706':17A,20A '-2026':16A,19A 'attack':12A 'code':14A 'cve':15A,18A 'discoveri':10A 'free':5A 'layer':9A 'let':11A 'link':8A 'link-lay':7A 'run':13A 'use':3A 'use-after-fre':2A 'window':1A","search_b":"'adjac':53B 'attack':42B,49B,58B 'bug':29B 'code':44B 'discoveri':36B 'free':28B 'handl':38B 'infrastructur':21B 'layer':34B 'let':39B 'link':33B 'local':64B 'machin':47B 'must':59B 'network':22B,54B,65B 'protocol':37B 'run':43B 'segment':55B 'topolog':35B 'travel':50B 'unauthor':41B 'use':26B 'use-after-fre':25B 'window':23B,32B","search_c":"'adjac':85C 'allow':76C 'attack':79C 'code':82C 'discoveri':74C 'execut':81C 'free':68C 'layer':72C 'link':71C 'network':86C 'protocol':75C 'topolog':73C 'unauthor':78C 'use':66C 'window':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116706","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116706","severity":null,"published_at":"2026-11-10T19:19:12+00:00","modified_at":"2026-11-10T19:19:12+00:00","first_seen_at":"2026-11-10T19:24:45+00:00","fetched_at":"2026-11-10T19:24:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}