Windows Smart Card: Heap-based buffer overflow enables privilege escalation

Summary

A heap-based buffer overflow in the Windows Smart Card component allows an authorized local user to elevate privileges. The attack requires physical access to the device and a low-privileged account. If exploited, the vulnerability could fully compromise confidentiality, integrity and availability of the affected system.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core)
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core)
• Windows 10 Version 21H2 and 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2
• Windows Server 2022
• Affected builds are listed as earlier than the fixed builds in the CNA record (for example 10.0.22631.7711 for Windows 11 23H2)

Fixed in

• Security updates released on November 10, 2026
• Fixed builds per CNA record: 10.0.14393.9688 (1607/Server 2016), 10.0.17763.9487 (1809/Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.20348.5870 (Server 2022), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.26300.9974 (26H2), 10.0.28000.3501 (26H1)
• Verify exact builds and KB numbers on the MSRC advisory before deployment

Workaround

Unknown.

• No vendor-published workaround found. Apply physical controls: lock unattended devices, enable screen locks, do not leave logged-in terminals unattended.

Exploitation

• No public proof of concept or exploitation in the wild known at time of writing.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• Rapid7 rates exploitation as less likely; not publicly disclosed.

Our recommendation

• Deploy the November 10, 2026 security updates in the normal Patch Tuesday cycle, with earlier deployment on shared workstations, kiosks and devices using smart card logon.
• Patch the whole batch of Smart Card elevation of privilege CVEs released the same day together.
• Check which systems have laptops leaving the office or shared machines and prioritize them.
• Enforce physical security and screen locks on all endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-118144 msrc.microsoft.com
• CVE Record CVE-2026-118144 (CNA Microsoft) www.cve.org
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Senserva KB 5132061 summary senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:44.