Windows Device Inventory: Heap-based buffer overflow allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows Device Inventory component allows an authorized local user to elevate privileges. The CVSS vector requires local access, high attack complexity and low privileges, so an attacker first needs a low-privileged foothold on the system. The function of the component is not described in the available sources.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688) - Windows 10 Version 1809 (builds before 10.0.17763.9487) - Windows 10 Version 21H2 (builds before 10.0.19044.7846) - Windows 10 Version 22H2 (builds before 10.0.19045.7846, per third-party tracker only) - Windows 11 Version 23H2 (builds before 10.0.22631.7711) - Windows 11 Version 24H2 (builds before 10.0.26100.9974) - Windows 11 Version 25H2 (builds before 10.0.26200.9974) - Windows 11 Version 26H1 (builds before 10.0.28000.3501) - Windows 11 Version 26H2 (builds before 10.0.26300.9974) - Windows Server 2016 and Server Core (builds before 10.0.14393.9688) - Windows Server 2019 and Server Core (builds before 10.0.17763.9487) - Windows Server 2022 (builds before 10.0.20348.5870)

Fixed in

Install the Microsoft update from November 2026 (Patch Tuesday). The CVE record lists the fixed builds above; the fixed build for Windows 10 22H2 is confirmed only by a third-party tracker. Verify each build against the MSRC advisory.

Workaround

Unknown. No vendor-published workaround was found. Installing the update is the mitigation. General hardening: limit local logon rights, remove unnecessary local accounts and enforce least privilege.

Exploitation

• No known public exploit code (CVSS exploit maturity: Unproven). - CISA SSVC assessment: exploitation none, not automatable, total technical impact. - No evidence of exploitation in the wild found in the sources. - Some reports on the November 2026 release mention other exploited vulnerabilities, but none name this CVE.

Our recommendation

• Inventory Windows 10 and Windows Server systems and check their build numbers against the list above. - Install the November 2026 security update, prioritizing Server systems and hosts with shared file or domain services. - Plan upgrades or ESU coverage for old builds (1607, 1809, 21H2) that no longer receive security updates. - Restrict local logon rights and remove unneeded local accounts. - Recheck NVD and CISA KEV for changes, because NVD still shows 'Awaiting Analysis'.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org record CVE-2026-113750 www.cve.org
• Microsoft Security Update Guide CVE-2026-113750 msrc.microsoft.com
• Strix CVE-2026-113750 (third-party, verify against MSRC) www.strix.ai
• Tenable: Microsoft November 2026 Patch Tuesday www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:05.