{"id":"CVE-2026-122176","kind":"vulnerability","aliases":["CVE-2026-122176"],"related":[],"title":"Windows SMB: heap overflow lets an authorized user run code remotely","description":"Heap-based buffer overflow in Windows SMB allows an authorized attacker to execute code over a network.","summary":"Heap-based buffer overflow in the Windows SMB component (CWE-122). An authenticated attacker with low privileges can send a crafted request over the network and run code on the server. Microsoft rates it Important (CVSS 8.8), says it is not exploited and not publicly disclosed, and marks it Exploitation Less Likely.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10/11 and Windows Server 2016-2025","fixed":["Nov 2026 cumulative update"],"affected":"Win10 1607 <10.0.14393.9688; 1809 <10.0.17763.9487; 21H2 <10.0.19044.7846; 22H2 <10.0.19045.7846; Win11 23H2 <10.0.22631.7711; 24H2 <10.0.26100.9974; 25H2 <10.0.26200.9974; 26H1 <10.0.28000.3501; 26H2 <10.0.26300.9974; Server 2022 <10.0.20348.5870; Server 2025 <10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["file-sharing","infrastructure","remote-code-execution","self-hosted","smb","windows"],"not_affected_if":["patched","smb-blocked","smb-not-exposed"],"how_to_check":"Run winver or (Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').UBR and compare the build with the fixed builds listed; Get-HotFix lists installed updates. Check which hosts listen on TCP 445: Get-NetTCPConnection -LocalPort 445 -State Listen.","fix":"Install the November 2026 Windows cumulative update. Fixed builds per the CVE record: Win10 1607/Server 2016 10.0.14393.9688; Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822.","status":"open","published_at":"2026-11-10T19:20:35+00:00","first_seen_at":"2026-11-10T19:25:10+00:00","triaged_at":"2026-11-10T19:27:47+00:00","updated_at":"2026-11-10T21:40:03+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-11-10T19:27:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows SMB: heap overflow lets an authorized user run code remotely","impact":"high","summary":"A heap-based buffer overflow in the Windows SMB file-sharing component lets an attacker who already has valid access run code over the network. The sources give a CVSS score of 8.8 and no details on affected versions or fixes.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","smb","file-sharing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker runs code on the Windows host over the network","analyst_note":"Check Microsoft's security update guide for CVE-2026-122176 for affected Windows versions, fixed builds and mitigations.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["smb-not-exposed"],"who_is_affected":"Systems running Windows with the SMB file-sharing service reachable on the network may be exposed. The sources do not say which Windows versions are affected or whether default configurations are vulnerable. Machines that do not expose SMB to the network can likely skip it, but the sources do not confirm this.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4484,"output_tokens":460,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Microsoft's security update guide for CVE-2026-122176 for affected Windows versions, fixed builds and mitigations.","search":"'-122':49B '-122176':14A,17A '-2025':24A '-2026':13A,16A '10/11':19A '2016':23A '8.8':75B 'allow':99C 'and':20A 'attack':52B,102C 'authent':51B 'author':7A,101C 'base':40B,93C 'buffer':41B,94C 'code':10A,31B,66B,105C 'compon':47B 'craft':59B 'cve':12A,15A 'cvss':74B 'cwe':48B 'disclos':84B 'execut':32B,104C 'exploit':80B,88B 'file':26B 'file-shar':25B 'heap':3A,39B,92C 'heap-bas':38B,91C 'host':35B 'import':73B 'infrastructur':28B 'less':89B 'let':5A 'like':90B 'low':54B 'mark':86B 'microsoft':70B 'network':63B,108C 'overflow':4A,42B,95C 'privileg':55B 'public':83B 'rate':71B 'remot':11A,30B 'remote-code-execut':29B 'request':60B 'run':9A,65B 'say':76B 'self':34B 'self-host':33B 'send':57B 'server':22A,69B 'share':27B 'smb':2A,36B,46B,98C 'user':8A 'window':1A,37B,45B,97C 'windows':18A,21A","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10, Windows 11 or Windows Server 2016-2025 machine that accepts SMB connections (file servers, domain members, workstations with file sharing) and is below the November 2026 fixed build. The attacker needs a valid low-privilege account and network access to SMB, so exposure is mostly lateral movement inside a network or SMB exposed to the internet. Hosts that block SMB (TCP 445) from untrusted networks are far less reachable, though the patch is still needed.","tier":"B","verified":{"who_affected":{"at":"2026-11-10T21:40:03Z","by":"analyst","doc":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-122176","run_id":2831}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["1011andwindowsserver20162025","windows1011andwindowsserver20162025"],"ptokens":["10","11","2016","2025","and","server","windows"],"labels":["filesharing","high","infrastructure","remotecodeexecution","selfhosted","smb","windows"],"campaign_type":null,"search_a":"'-122176':14A,17A '-2025':24A '-2026':13A,16A '10/11':19A '2016':23A 'and':20A 'author':7A 'code':10A 'cve':12A,15A 'heap':3A 'let':5A 'overflow':4A 'remot':11A 'run':9A 'server':22A 'smb':2A 'user':8A 'window':1A 'windows':18A,21A","search_b":"'-122':49B '8.8':75B 'attack':52B 'authent':51B 'base':40B 'buffer':41B 'code':31B,66B 'compon':47B 'craft':59B 'cvss':74B 'cwe':48B 'disclos':84B 'execut':32B 'exploit':80B,88B 'file':26B 'file-shar':25B 'heap':39B 'heap-bas':38B 'host':35B 'import':73B 'infrastructur':28B 'less':89B 'like':90B 'low':54B 'mark':86B 'microsoft':70B 'network':63B 'overflow':42B 'privileg':55B 'public':83B 'rate':71B 'remot':30B 'remote-code-execut':29B 'request':60B 'run':65B 'say':76B 'self':34B 'self-host':33B 'send':57B 'server':69B 'share':27B 'smb':36B,46B 'window':37B,45B","search_c":"'allow':99C 'attack':102C 'author':101C 'base':93C 'buffer':94C 'code':105C 'execut':104C 'heap':92C 'heap-bas':91C 'network':108C 'overflow':95C 'smb':98C 'window':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122176","severity":null,"published_at":"2026-11-10T19:20:35+00:00","modified_at":"2026-11-10T19:20:35+00:00","first_seen_at":"2026-11-10T19:25:10+00:00","fetched_at":"2026-11-10T19:25:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122176:2831","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-122176","severity":null,"published_at":"2026-11-10T21:40:03+00:00","modified_at":"2026-11-10T21:40:03+00:00","first_seen_at":"2026-11-10T21:40:03+00:00","fetched_at":"2026-11-10T21:40:03+00:00","note":"Read MSRC Security Update Guide API record (primary): Important, 8.8, not exploited, not publicly disclosed, Exploitation Less Likely, Nov 2026 Patch Tuesday. Fixed builds taken from CVE record via OpenCVE (not read on MSRC page itself), so fix not marked verified.","cites":["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-122176","https://app.opencve.io/cve/CVE-2026-122176"]}],"documents":[{"id":118970,"url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-122176","title":"MSRC: CVE-2026-122176 Windows SMB Remote Code Execution Vulnerability","kind":"advisory","source":"analyst","publisher":null,"text":"Microsoft Security Update Guide record, 2026-11-10. Heap-based buffer overflow in Windows SMB allows an authorized attacker to execute code over a network. Important, CVSS 8.8 (temporal 7.7), CWE-122. Exploited: No. Publicly disclosed: No. Exploitability: Exploitation Less Likely. Customer action required. FAQ: An authenticated attacker with low-level access to an affected server could send a specially crafted request to execute code on the server. No user interaction.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118972,"url":"https://app.opencve.io/cve/CVE-2026-122176","title":"OpenCVE: CVE-2026-122176 (CVE record affected builds)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}