{"id":"CVE-2026-88231","kind":"vulnerability","aliases":["CVE-2026-88231"],"related":[],"title":"Windows iSCSI: out-of-bounds read leaks memory to authorized network attackers","description":"Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information over a network.","summary":"Windows iSCSI reads memory past the end of a buffer when handling a request, so an attacker who already has authorized access over the network can read data they should not see. The sources describe information disclosure only, not code execution.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","iscsi","self-hosted","windows"],"not_affected_if":["iscsi-not-enabled","no-network-exposure"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:31+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","triaged_at":"2026-11-10T20:00:12+00:00","updated_at":"2026-11-10T20:00:12+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:00:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows iSCSI: out-of-bounds read leaks memory to authorized network attackers","impact":"low","summary":"Windows iSCSI reads memory past the end of a buffer when handling a request, so an attacker who already has authorized access over the network can read data they should not see. The sources describe information disclosure only, not code execution.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","iscsi","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads leaked memory contents over the network","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-88231 to confirm affected Windows builds and the patch.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["iscsi-not-enabled","no-network-exposure"],"who_is_affected":"Machines running the Windows iSCSI initiator or target service that accept iSCSI connections over the network. Systems without the iSCSI service enabled, or not reachable on the iSCSI network, are not exposed. The sources do not name affected Windows builds.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000689,"input_tokens":4487,"output_tokens":480,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-88231':16A,19A 'access':47B 'allow':75C 'alreadi':44B 'attack':13A,42B,78C 'author':11A,46B,77C 'bound':6A,70C 'buffer':35B 'code':65B 'cve':14A,17A 'data':53B 'describ':60B 'disclos':80C 'disclosur':62B 'end':32B 'execut':66B 'handl':37B 'host':24B 'inform':61B,81C 'infrastructur':20B 'iscsi':2A,21B,27B,74C 'leak':8A 'memori':9A,29B 'network':12A,50B,84C 'out-of-bound':3A,67C 'past':30B 'read':7A,28B,52B,71C 'request':39B 'see':57B 'self':23B 'self-host':22B 'sourc':59B 'window':1A,25B,26B,73C","nicknames":[],"mitigations":[],"who_affected":"Machines running the Windows iSCSI initiator or target service that accept iSCSI connections over the network. Systems without the iSCSI service enabled, or not reachable on the iSCSI network, are not exposed. The sources do not name affected Windows builds.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","iscsi","medium","selfhosted","windows"],"campaign_type":null,"search_a":"'-2026':15A,18A '-88231':16A,19A 'attack':13A 'author':11A 'bound':6A 'cve':14A,17A 'iscsi':2A 'leak':8A 'memori':9A 'network':12A 'out-of-bound':3A 'read':7A 'window':1A","search_b":"'access':47B 'alreadi':44B 'attack':42B 'author':46B 'buffer':35B 'code':65B 'data':53B 'describ':60B 'disclosur':62B 'end':32B 'execut':66B 'handl':37B 'host':24B 'inform':61B 'infrastructur':20B 'iscsi':21B,27B 'memori':29B 'network':50B 'past':30B 'read':28B,52B 'request':39B 'see':57B 'self':23B 'self-host':22B 'sourc':59B 'window':25B,26B","search_c":"'allow':75C 'attack':78C 'author':77C 'bound':70C 'disclos':80C 'inform':81C 'iscsi':74C 'network':84C 'out-of-bound':67C 'read':71C 'window':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88231","severity":null,"published_at":"2026-11-10T19:21:31+00:00","modified_at":"2026-11-10T19:21:31+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","fetched_at":"2026-11-10T19:25:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}