Microsoft Windows Smart Card: Elevation of privilege via heap-based buffer overflow

Summary

A heap-based buffer overflow in the Windows Smart Card component allows an authorized local user to elevate privileges. The CVSS base score is 7.8 (high). An attacker needs an existing local foothold, such as a user account or malware on the host, and can then gain SYSTEM rights, which means full compromise of that host. The flaw is not internet-facing and no exploitation or public proof of concept is known.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (builds below 10.0.14393.9688)
• Windows 10 Version 1809 and Windows Server 2019 (builds below 10.0.17763.9487)
• Windows 10 Version 21H2 (builds below 10.0.19044.7846)
• Windows 10 Version 22H2 (builds below 10.0.19045.7846)
• Windows 11 Version 23H2 (builds below 10.0.22631.7711)
• Windows 11 Version 24H2 and 25H2 (builds below 10.0.26100.9974 and 10.0.26200.9974; 24H2 build value to be verified)
• Windows 11 Version 26H1 (builds below 10.0.28000.3501)
• Windows 11 Version 26H2 (builds below 10.0.26300.9974)
• Windows Server 2022 (builds below 10.0.20348.5870)
• Unknown: exact status of all listed branches and whether each is still serviced.

Fixed in

• Security updates published with the November 2026 Patch Tuesday, for example KB5132059 (Windows 11 26H1) and KB5131096 (Windows 10 21H2) according to a secondary source; confirm on MSRC or the Microsoft Update Catalog.
• Fixed builds are the versions at or above the values listed under affected.

Workaround

• Unknown: no workaround is documented in the sources reviewed. Installing the update is the fix.

Exploitation

• Not known to be exploited in the wild.
• Microsoft's temporal vector sets exploit code maturity to unproven.
• No public proof of concept found; searches were limited.
• Not listed in CISA KEV at the time of review.

Our recommendation

• Install the November 2026 security updates on all affected systems, starting with servers, Remote Desktop hosts and multi-user systems.
• Verify the installed build against the MSRC advisory before and after rollout.
• Restrict local logon to trusted users and disable smart card services where they are not required.
• Review related Smart Card CVE-2026-83584 (use-after-free, October 2026) and patch it as well.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-112794 msrc.microsoft.com
• CVE.org Record CVE-2026-112794 www.cve.org
• Strix: CVE-2026-112794 www.strix.ai
• Senserva: KB5132059 senserva.com
• Senserva: KB5131096 senserva.com
• Vulners: CVE-2026-83584 (related Smart Card CVE) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:17.