Microsoft Windows NetBIOS: Elevation of privilege via use after free

Summary

A use-after-free flaw in the Windows NetBIOS component allows an authorized local attacker with low privileges to elevate their privileges to a higher level, potentially to full system control. The attack complexity is high and local logon access is required, so this is not a remote, unauthenticated vulnerability. Microsoft rates the impact as Important; the exploitation status is not clear from the sources reviewed.

Affected

• Windows 10 Version 1607, 1809, 21H2, 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1, 26H2
• Windows Server 2016 (including Server Core), 2019 (including Server Core), 2022, 2025
• Affected builds below the fixed builds listed in the MSRC advisory

Fixed in

• Windows 10 1607: 10.0.14393.9688
• Windows 10 1809: 10.0.17763.9487
• Windows 10 21H2: 10.0.19044.7846
• Windows 10 22H2: 10.0.19045.7846
• Windows 11 23H2: 10.0.22631.7711
• Windows 11 24H2: 10.0.26100.9974
• Windows 11 25H2: 10.0.26200.9974
• Windows 11 26H1: 10.0.28000.3501
• Windows 11 26H2: 10.0.26300.9974
• Windows Server 2016: 10.0.14393.9688
• Windows Server 2019: 10.0.17763.9487
• Windows Server 2022: 10.0.20348.5870
• Windows Server 2025: 10.0.26100.33822
• Build numbers must be verified against the MSRC advisory before use. KB numbers: unknown.

Workaround

Unknown. No vendor workaround or mitigation was identified.

• Stopgap (not vendor-sourced): where NetBIOS over TCP/IP is not required, disabling it reduces the attack surface. Test first, as some legacy applications depend on it.

Exploitation

• Exploitation in the wild for this CVE is unconfirmed and unclear. Microsoft reportedly notes one vulnerability in the November 2026 release as exploited, but the sources do not clearly name this CVE.
• The CVE record scores exploit code maturity as Unproven (E:U).
• No public proof-of-concept exploit found.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Check the "Exploited" and "Publicly disclosed" fields on the MSRC advisory.
• Apply the November 2026 cumulative update to all affected Windows clients and servers, prioritising shared systems and terminal servers.
• Where NetBIOS is not required, review whether it can be disabled after testing.
• Monitor for an NVD entry and any public proof-of-concept exploit.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-112798 msrc.microsoft.com
• CVE Record CVE-2026-112798 www.cve.org
• Talos: Microsoft Patch Tuesday for November 2026 blog.talosintelligence.com
• Qualys: Microsoft Patch Tuesday November 2026 blog.qualys.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:15.