{"id":"CVE-2026-118142","kind":"vulnerability","aliases":["CVE-2026-118142"],"related":[],"title":"Windows DFS: out-of-bounds read lets a local user gain higher privileges","description":"Out-of-bounds read in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges locally.","summary":"A memory read past the end of a buffer in Windows Distributed File System lets an already-authorized local user elevate their privileges. An attacker who can log on to the machine could gain system-level control.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["active-directory","dfs","infrastructure","windows"],"not_affected_if":["non-windows-systems"],"how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft update notes for this CVE\n- Confirm whether the DFS role or DFS client components are in use with `Get-WindowsFeature FS-DFS-Namespace`","fix":null,"status":"open","published_at":"2026-11-10T19:19:34+00:00","first_seen_at":"2026-11-10T19:24:49+00:00","triaged_at":"2026-11-10T19:40:42+00:00","updated_at":"2026-11-10T19:40:42+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:40:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows DFS: out-of-bounds read lets a local user gain higher privileges","impact":"high","summary":"A memory read past the end of a buffer in Windows Distributed File System lets an already-authorized local user elevate their privileges. An attacker who can log on to the machine could gain system-level control.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","dfs","active-directory"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the Windows machine","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-118142 to confirm affected Windows builds, the fixed update, and whether DFS must be enabled.","how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft update notes for this CVE\n- Confirm whether the DFS role or DFS client components are in use with `Get-WindowsFeature FS-DFS-Namespace`","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["non-windows-systems"],"who_is_affected":"Only Windows machines with local logon access are at risk, since the attacker must already be authorized on the system. The sources do not say whether DFS must be actively configured for the flaw to be reachable, so treat all Windows servers and workstations as in scope until Microsoft's advisory is checked.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00072,"input_tokens":4500,"output_tokens":540,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-118142 to confirm affected Windows builds, the fixed update, and whether DFS must be enabled.","search":"'-118142':17A,20A '-2026':16A,19A 'activ':22B 'active-directori':21B 'allow':77C 'alreadi':44B 'already-author':43B 'attack':52B,80C 'author':45B,79C 'bound':6A,69C 'buffer':35B 'control':65B 'could':60B 'cve':15A,18A 'dfs':2A,24B,76C 'directori':23B 'distribut':38B,73C 'elev':48B,82C 'end':32B 'file':39B,74C 'gain':12A,61B 'higher':13A 'infrastructur':25B 'let':8A,41B 'level':64B 'local':10A,46B,84C 'log':55B 'machin':59B 'memori':28B 'out-of-bound':3A,66C 'past':30B 'privileg':14A,50B,83C 'read':7A,29B,70C 'system':40B,63B,75C 'system-level':62B 'user':11A,47B 'window':1A,26B,37B,72C","nicknames":[],"mitigations":[],"who_affected":"Only Windows machines with local logon access are at risk, since the attacker must already be authorized on the system. The sources do not say whether DFS must be actively configured for the flaw to be reachable, so treat all Windows servers and workstations as in scope until Microsoft's advisory is checked.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["activedirectory","dfs","high","infrastructure","windows"],"campaign_type":null,"search_a":"'-118142':17A,20A '-2026':16A,19A 'bound':6A 'cve':15A,18A 'dfs':2A 'gain':12A 'higher':13A 'let':8A 'local':10A 'out-of-bound':3A 'privileg':14A 'read':7A 'user':11A 'window':1A","search_b":"'activ':22B 'active-directori':21B 'alreadi':44B 'already-author':43B 'attack':52B 'author':45B 'buffer':35B 'control':65B 'could':60B 'dfs':24B 'directori':23B 'distribut':38B 'elev':48B 'end':32B 'file':39B 'gain':61B 'infrastructur':25B 'let':41B 'level':64B 'local':46B 'log':55B 'machin':59B 'memori':28B 'past':30B 'privileg':50B 'read':29B 'system':40B,63B 'system-level':62B 'user':47B 'window':26B,37B","search_c":"'allow':77C 'attack':80C 'author':79C 'bound':69C 'dfs':76C 'distribut':73C 'elev':82C 'file':74C 'local':84C 'out-of-bound':66C 'privileg':83C 'read':70C 'system':75C 'window':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118142","severity":null,"published_at":"2026-11-10T19:19:34+00:00","modified_at":"2026-11-10T19:19:34+00:00","first_seen_at":"2026-11-10T19:24:49+00:00","fetched_at":"2026-11-10T19:24:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}