IT SBIT Services
Schneeberger
DEEN
CVE tracker

Windows SMB Server: Remote code execution due to integer overflow

CVE-2026-112972High 7.5

← All vulnerabilities

Summary

An integer overflow (CWE-190) in the SMBv3 server component of Windows allows an attacker to execute code on the target system over the network. Per the CVSS vector, attack complexity is high and the attacker needs low privileges, so a valid account or another way to authenticate is required; no user interaction is needed. If SMB is reachable from untrusted networks, the risk is considerably higher.

Affected

  • Windows 10 Version 1607, 1809, 21H2 and 22H2
  • Windows 11 Version 23H2, 24H2, 25H2 and 26H2, and version 26H1
  • Windows Server 2016 (including Server Core), 2019 (including Server Core) and 2022
  • Affected builds according to the Microsoft CNA record are below the fixed builds listed under 'Fixed'. Verification on MSRC is pending.

Fixed in

Unverified: MSRC was not accessed and the KB article numbers are unknown. Fixed builds according to the Microsoft CNA record:

  • Windows 10 1607 and Windows Server 2016: 10.0.14393.9688
  • Windows 10 1809 and Windows Server 2019: 10.0.17763.9487
  • Windows 10 21H2: 10.0.19044.7846
  • Windows 10 22H2: 10.0.19045.7846
  • Windows 11 23H2: 10.0.22631.7711
  • Windows 11 24H2: 10.0.26100.9974
  • Windows 11 25H2: 10.0.26200.9974
  • Windows 11 26H1: 10.0.28000.3501
  • Windows 11 26H2: 10.0.26300.9974
  • Windows Server 2022: 10.0.20348.5870

Workaround

Unknown. No vendor workaround or mitigation was found in the sources reviewed.

  • Block SMB (TCP 445) at the perimeter so that it is not reachable from the internet.
  • Restrict SMB access internally to the systems that need it.

Exploitation

  • No exploitation of this CVE in the wild was found in the sources reviewed.
  • CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
  • Microsoft's CNA vector states exploit code maturity unproven (E:U) and report confidence confirmed (RC:C).
  • No public proof of concept was found; this does not confirm that none exists.
  • VulDB lists CVE-2026-119988 as a possibly related duplicate; this is unverified.

Our recommendation

  • Install the November 2026 security update on all affected systems, prioritising file servers and systems with SMB exposed internally. Verify the fixed build against MSRC first.
  • Block SMB (TCP 445) at the firewall and check that no SMB service is exposed to the internet.
  • Restrict SMB access to necessary systems and users, and review accounts with network access.
  • Monitor for unusual SMB traffic and watch for changes in exploitation status and NVD analysis.

Information from Microsoft (Patch Tuesday November 2026)

Severity (Microsoft)
Important
Impact
Remote code execution – Windows SMB Server
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:57.

Original description (NVD)

Integer overflow or wraparound in Windows SMB Server allows an authorized attacker to execute code over a network.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed