Microsoft Windows NTFS: Null pointer dereference allows local code execution

Summary

A null pointer dereference in the Windows NTFS file system component allows an unauthorized attacker to execute code locally, according to the CVE description. The CVE title says Remote Code Execution, which conflicts with the local attack vector in the description and CVSS vector, so the attack path must be confirmed with Microsoft. The CVSS base score is 7.8 (High) and requires user interaction. Exploitation requires a local user context and user interaction, for example opening a malicious file or program.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)

Fixed in

• Fixed builds confirmed by the CVE.org record: Windows 10 1607 (10.0.14393.9688), 1809 (10.0.17763.9487) and 21H2 (10.0.19044.7846).
• Fix is released with the November 2026 Patch Tuesday.
• Other fixed builds are unverified and must be confirmed in the MSRC advisory.
• No KB number confirmed.

Workaround

Unknown.

• No vendor workaround found.
• Patching is the only confirmed fix.

Exploitation

• Microsoft assessment: exploit maturity Unproven (U).
• CISA SSVC: exploitation none, not automatable, total technical impact.
• No public proof of concept or in-the-wild exploitation known as of 11 November 2026.

Our recommendation

• Patch Windows 10, Windows 11 and Windows Server hosts with the November 2026 security update, prioritising Windows 10 1607, 1809, 21H2 and 22H2 and Server 2016 and 2019.
• Verify the fixed build numbers in the MSRC advisory before rollout.
• Restrict local logon to trusted users, especially on file servers.
• Limit execution of untrusted files and monitor for unusual local privilege escalation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-113848 msrc.microsoft.com
• CVE.org CVE Record CVE-2026-113848 www.cve.org
• Strix CVE entry CVE-2026-113848 www.strix.ai
• BleepingComputer: November 2026 Patch Tuesday www.bleepingcomputer.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:08.