Microsoft Windows: TOCTOU race condition in Redirected Drive Buffering
Summary
Microsoft Windows contains a time-of-check time-of-use (TOCTOU) race condition in the Redirected Drive Buffering component, tracked as CVE-2026-113772. An authorized, low-privileged local user who wins a high-complexity race can disclose information, with no impact on integrity or availability. The vulnerability is not reachable remotely, no exploitation has been reported, and NVD analysis is still pending.
Affected
- Windows 10 Version 1607 (builds before 10.0.14393.9688)
- Windows 10 Version 1809 (builds before 10.0.17763.9487)
- Windows 10 Version 21H2 (builds before 10.0.19044.7846)
- Windows 10 Version 22H2 (builds before 10.0.19045.7846)
- Windows 11 Version 23H2 (builds before 10.0.22631.7711)
- Windows 11 Version 24H2 (builds before 10.0.26100.9974)
- Windows 11 Version 25H2 (builds before 10.0.26200.9974)
- Windows 11 Version 26H1 (builds before 10.0.28000.3501)
- Windows 11 Version 26H2 (builds before 10.0.26300.9974)
- Windows Server 2016 incl. Server Core (builds before 10.0.14393.9688)
- Windows Server 2019 incl. Server Core (builds before 10.0.17763.9487)
- Windows Server 2022 (builds before 10.0.20348.5870)
Fixed in
- Install the Microsoft security update for each affected version. The fixed builds are the build numbers listed above, according to the CNA record.
- Corresponding KB numbers: Unknown. Verify them in the MSRC Security Update Guide or the Microsoft Update Catalog.
Workaround
Unknown.
Exploitation
- Not known to be exploited in the wild.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- No public proof of concept found in a limited search.
Our recommendation
- Install the security update through the normal monthly Windows patch cycle, prioritising terminal servers and shared multi-user systems.
- Verify the affected build list and KB numbers in the MSRC Security Update Guide.
- Limit local logon on shared systems to trusted users.
- Re-check NVD and MSRC once analysis is complete.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Information disclosure – Windows Redirected Drive Buffering
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE.org record (Microsoft CNA) www.cve.org
- Microsoft Security Update Guide (MSRC) msrc.microsoft.com
- Strix.ai CVE summary www.strix.ai
- Senserva KB 5131087 (third-party, KB mapping unverified) senserva.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:53.
Original description (NVD)
Time-of-check time-of-use (toctou) race condition in Windows Redirected Drive Buffering allows an authorized attacker to disclose information locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.