{"id":"CVE-2026-118145","kind":"vulnerability","aliases":["CVE-2026-118145"],"related":[],"title":"Windows: use-after-free in SSDP discovery lets attackers run code remotely","description":"Use after free in Windows Function Discovery SSDP Provider allows an unauthorized attacker to execute code over an adjacent network.","summary":"A use-after-free bug in the Windows Function Discovery SSDP Provider lets an unauthorized attacker on the adjacent network run code on the machine. The sources give a CVSS score of 7.5 and do not describe any exploitation in the wild.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","network-devices","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:19:34+00:00","first_seen_at":"2026-11-10T19:24:49+00:00","triaged_at":"2026-11-10T19:44:45+00:00","updated_at":"2026-11-10T19:44:45+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:44:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows: use-after-free in SSDP discovery lets attackers run code remotely","impact":"high","summary":"A use-after-free bug in the Windows Function Discovery SSDP Provider lets an unauthorized attacker on the adjacent network run code on the machine. The sources give a CVSS score of 7.5 and do not describe any exploitation in the wild.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","network-devices"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"code runs on the Windows machine with attacker's privileges","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-118145 to confirm affected Windows builds, the fixed build and whether a default setting makes SSDP discovery reachable.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Windows machines with the Function Discovery SSDP Provider service in use are the systems to look at, since the flaw is reachable from the adjacent network. The sources do not say which Windows versions or default configurations are affected, so teams should confirm that against the vendor advisory.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":4498,"output_tokens":479,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-118145 to confirm affected Windows builds, the fixed build and whether a default setting makes SSDP discovery reachable.","search":"'-118145':16A,19A '-2026':15A,18A '7.5':58B 'adjac':44B,86C 'allow':77C 'attack':10A,41B,80C 'bug':30B 'code':12A,47B,83C 'cve':14A,17A 'cvss':55B 'describ':62B 'devic':23B 'discoveri':8A,35B,74C 'execut':82C 'exploit':64B 'free':5A,29B,70C 'function':34B,73C 'give':53B 'infrastructur':20B 'let':9A,38B 'machin':50B 'network':22B,45B,87C 'network-devic':21B 'provid':37B,76C 'remot':13A 'run':11A,46B 'score':56B 'sourc':52B 'ssdp':7A,36B,75C 'unauthor':40B,79C 'use':3A,27B,68C 'use-after-fre':2A,26B 'wild':67B 'window':1A,24B,33B,72C","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the Function Discovery SSDP Provider service in use are the systems to look at, since the flaw is reachable from the adjacent network. The sources do not say which Windows versions or default configurations are affected, so teams should confirm that against the vendor advisory.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","networkdevices","windows"],"campaign_type":null,"search_a":"'-118145':16A,19A '-2026':15A,18A 'attack':10A 'code':12A 'cve':14A,17A 'discoveri':8A 'free':5A 'let':9A 'remot':13A 'run':11A 'ssdp':7A 'use':3A 'use-after-fre':2A 'window':1A","search_b":"'7.5':58B 'adjac':44B 'attack':41B 'bug':30B 'code':47B 'cvss':55B 'describ':62B 'devic':23B 'discoveri':35B 'exploit':64B 'free':29B 'function':34B 'give':53B 'infrastructur':20B 'let':38B 'machin':50B 'network':22B,45B 'network-devic':21B 'provid':37B 'run':46B 'score':56B 'sourc':52B 'ssdp':36B 'unauthor':40B 'use':27B 'use-after-fre':26B 'wild':67B 'window':24B,33B","search_c":"'adjac':86C 'allow':77C 'attack':80C 'code':83C 'discoveri':74C 'execut':82C 'free':70C 'function':73C 'network':87C 'provid':76C 'ssdp':75C 'unauthor':79C 'use':68C 'window':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118145","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118145","severity":null,"published_at":"2026-11-10T19:19:34+00:00","modified_at":"2026-11-10T19:19:34+00:00","first_seen_at":"2026-11-10T19:24:49+00:00","fetched_at":"2026-11-10T19:24:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}