{"id":"CVE-2026-125134","kind":"vulnerability","aliases":["CVE-2026-125134"],"related":[],"title":"Windows: use-after-free in Function Discovery lets attackers run code","description":"Use after free in Windows Function Discovery Resource Publication allows an unauthorized attacker to execute code over an adjacent network.","summary":"A use-after-free bug in the Windows Function Discovery Resource Publication component lets an unauthorized attacker run code on the affected machine. The attack comes over an adjacent network, meaning a host on the same local network segment.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"microsoft"}],"ecosystems":[],"tags":["adjacent-network","infrastructure","windows","windows-server"],"not_affected_if":["patched-nov-2026","unknown"],"how_to_check":"Run winver or PowerShell [System.Environment]::OSVersion / (Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').UBR and compare the build with the fixed builds listed in the fix field. Hosts on the same network segment as untrusted devices are the priority.","fix":"Install the November 2026 (Patch Tuesday) cumulative update. Fixed builds: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822.","status":"open","published_at":"2026-11-10T19:21:06+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","triaged_at":"2026-11-10T19:43:11+00:00","updated_at":"2026-11-10T21:25:45+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:43:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows: use-after-free in Function Discovery lets attackers run code","impact":"high","summary":"A use-after-free bug in the Windows Function Discovery Resource Publication component lets an unauthorized attacker run code on the affected machine. The attack comes over an adjacent network, meaning a host on the same local network segment.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the Windows machine over the local network","analyst_note":"Find the Microsoft advisory for CVE-2026-125134 to confirm affected Windows builds, fixed updates and default configuration; the NVD entry alone gives none.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Windows machines with the Function Discovery Resource Publication component reachable from a local network segment are the exposed systems. The sources do not say which Windows versions or default settings are affected, so the exact exposure is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000668,"input_tokens":4494,"output_tokens":438,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-125134 to confirm affected Windows builds, fixed updates and default configuration; the NVD entry alone gives none.","search":"'-125134':15A,18A '-2026':14A,17A '10':29A '11':20A,32A '2016':39A '2019':36A '2022':27A '2025':24A '22h2':30A '23h2':33A '24h2':21A 'adjac':41B,77B,106C 'adjacent-network':40B 'affect':70B 'allow':97C 'attack':10A,65B,73B,100C 'bug':53B 'code':12A,67B,103C 'come':74B 'compon':61B 'cve':13A,16A 'discoveri':8A,58B,94C 'execut':102C 'free':5A,52B,90C 'function':7A,57B,93C 'host':81B 'infrastructur':43B 'let':9A,62B 'local':85B 'machin':71B 'mean':79B 'network':42B,78B,86B,107C 'public':60B,96C 'resourc':59B,95C 'run':11A,66B 'segment':87B 'server':23A,26A,35A,38A,47B 'unauthor':64B,99C 'use':3A,50B,88C 'use-after-fre':2A,49B 'window':1A,44B,46B,56B,92C 'windows':19A,22A,25A,28A,31A,34A,37A 'windows-serv':45B","nicknames":[],"mitigations":[],"who_affected":"Windows 10, Windows 11 and Windows Server 2016/2019/2022/2025 machines below the November 2026 fixed builds are listed as affected. The attacker must be on the same network segment (adjacent) and the attack is rated high complexity, so networks with untrusted devices on the same LAN (shared offices, guest Wi-Fi, flat server networks) matter most. Default-configuration exposure is not stated in the sources I could read; Microsoft's Security Update Guide page did not render.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1022h2","1123h2","1124h2","server2016","server2019","server2022","server2025","windows1022h2","windows1123h2","windows1124h2","windowsserver2016","windowsserver2019","windowsserver2022","windowsserver2025"],"ptokens":["10","11","2016","2019","2022","2025","22h2","23h2","24h2","server","windows"],"labels":["adjacentnetwork","high","infrastructure","windows","windowsserver"],"campaign_type":null,"search_a":"'-125134':15A,18A '-2026':14A,17A '10':29A '11':20A,32A '2016':39A '2019':36A '2022':27A '2025':24A '22h2':30A '23h2':33A '24h2':21A 'attack':10A 'code':12A 'cve':13A,16A 'discoveri':8A 'free':5A 'function':7A 'let':9A 'run':11A 'server':23A,26A,35A,38A 'use':3A 'use-after-fre':2A 'window':1A 'windows':19A,22A,25A,28A,31A,34A,37A","search_b":"'adjac':41B,77B 'adjacent-network':40B 'affect':70B 'attack':65B,73B 'bug':53B 'code':67B 'come':74B 'compon':61B 'discoveri':58B 'free':52B 'function':57B 'host':81B 'infrastructur':43B 'let':62B 'local':85B 'machin':71B 'mean':79B 'network':42B,78B,86B 'public':60B 'resourc':59B 'run':66B 'segment':87B 'server':47B 'unauthor':64B 'use':50B 'use-after-fre':49B 'window':44B,46B,56B 'windows-serv':45B","search_c":"'adjac':106C 'allow':97C 'attack':100C 'code':103C 'discoveri':94C 'execut':102C 'free':90C 'function':93C 'network':107C 'public':96C 'resourc':95C 'unauthor':99C 'use':88C 'window':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125134","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125134","severity":null,"published_at":"2026-11-10T19:21:06+00:00","modified_at":"2026-11-10T19:21:07+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","fetched_at":"2026-11-10T19:25:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125134:2791","url":"https://nvd.nist.gov/vuln/detail/cve-2026-125134","severity":null,"published_at":"2026-11-10T21:25:45+00:00","modified_at":"2026-11-10T21:25:45+00:00","first_seen_at":"2026-11-10T21:25:45+00:00","fetched_at":"2026-11-10T21:25:45+00:00","note":"MSRC page is JS-only and did not render; affected/fixed builds taken from Microsoft CNA data on NVD. Not marked verified (no vendor page read). No exploitation reported at release per press; no PoC found. Also Win11 25H2/26H1/26H2 and Win10 21H2 per NVD; omitted from rows for brevity but listed in fix.","cites":["https://nvd.nist.gov/vuln/detail/cve-2026-125134","https://winaero.com/patch-tuesday-cumulative-updates-for-windows-11-and-10-november-10-2026/"]}],"documents":[{"id":118852,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-125134","title":"NVD CVE-2026-125134 (Microsoft CNA affected builds)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118027,"url":"https://winaero.com/patch-tuesday-cumulative-updates-for-windows-11-and-10-november-10-2026/","title":"Patch Tuesday cumulative updates, November 10, 2026 (Winaero)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}