---
id: "CVE-2026-122176"
page: "https://infrastack.ai/live/CVE-2026-122176"
kind: "vulnerability"
aliases: ["CVE-2026-122176"]
title: "Windows SMB: heap overflow lets an authorized user run code remotely"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 10/11 and Windows Server 2016-2025", "fixed": ["Nov 2026 cumulative update"], "affected": "Win10 1607 <10.0.14393.9688; 1809 <10.0.17763.9487; 21H2 <10.0.19044.7846; 22H2 <10.0.19045.7846; Win11 23H2 <10.0.22631.7711; 24H2 <10.0.26100.9974; 25H2 <10.0.26200.9974; 26H1 <10.0.28000.3501; 26H2 <10.0.26300.9974; Server 2022 <10.0.20348.5870; Server 2025 <10.0.26100.33822", "ecosystem": "vendor"}]
ecosystems: []
tags: ["file-sharing", "infrastructure", "remote-code-execution", "self-hosted", "smb", "windows"]
not_affected_if: ["patched", "smb-blocked", "smb-not-exposed"]
published_at: "2026-11-10T19:20:35+00:00"
first_seen_at: "2026-11-10T19:25:10+00:00"
updated_at: "2026-11-10T21:40:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122176", "first_seen_at": "2026-11-10T19:25:10+00:00"}, {"source": "analyst", "url": "https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-122176", "first_seen_at": "2026-11-10T21:40:03+00:00", "cites": ["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-122176", "https://app.opencve.io/cve/CVE-2026-122176"]}]
exploit_sources: []
---

# Windows SMB: heap overflow lets an authorized user run code remotely

Link for people: https://infrastack.ai/live/CVE-2026-122176 (this .md is for agents)

Heap-based buffer overflow in the Windows SMB component (CWE-122). An authenticated attacker with low privileges can send a crafted request over the network and run code on the server. Microsoft rates it Important (CVSS 8.8), says it is not exploited and not publicly disclosed, and marks it Exploitation Less Likely.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows 10/11 and Windows Server 2016-2025 affected Win10 1607 <10.0.14393.9688; 1809 <10.0.17763.9487; 21H2 <10.0.19044.7846; 22H2 <10.0.19045.7846; Win11 23H2 <10.0.22631.7711; 24H2 <10.0.26100.9974; 25H2 <10.0.26200.9974; 26H1 <10.0.28000.3501; 26H2 <10.0.26300.9974; Server 2022 <10.0.20348.5870; Server 2025 <10.0.26100.33822 fixed Nov 2026 cumulative update

## How to check

Run winver or (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR and compare the build with the fixed builds listed; Get-HotFix lists installed updates. Check which hosts listen on TCP 445: Get-NetTCPConnection -LocalPort 445 -State Listen.

## Fix

Install the November 2026 Windows cumulative update. Fixed builds per the CVE record: Win10 1607/Server 2016 10.0.14393.9688; Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822.

## Timeline

- 2026-11-10T19:25:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122176
- 2026-11-10T21:40:03+00:00 analyst https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-122176 — Read MSRC Security Update Guide API record (primary): Important, 8.8, not exploited, not publicly disclosed, Exploitation Less Likely, Nov 2026 Patch Tuesday. Fixed builds taken from CVE record via OpenCVE (not read on MSRC page itself), so fix not marked verified.

## Documents

- [advisory] MSRC: CVE-2026-122176 Windows SMB Remote Code Execution Vulnerability https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-122176
- [describes] OpenCVE: CVE-2026-122176 (CVE record affected builds) https://app.opencve.io/cve/CVE-2026-122176

## From the sources

Heap-based buffer overflow in Windows SMB allows an authorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_