Microsoft Windows SMB: Remote code execution via numeric truncation
Summary
Windows SMB, the Windows file and printer sharing protocol, contains a numeric truncation error (CWE-197) in Windows 10, Windows 11 and Windows Server 2016 to 2022. An authorized attacker with a valid low-privilege account can execute code over the network. Exploitation is hard (AC:H) and requires user interaction (UI:R). The CNA scores it CVSS 3.1 7.1 while VulDB rates it 9.9, and no exploitation is known yet.
Affected
- Windows 10 1607: builds before 10.0.14393.9688
- Windows 10 1809: builds before 10.0.17763.9487
- Windows 10 21H2: builds before 10.0.19044.7846
- Windows 10 22H2: builds before 10.0.19045.7846
- Windows 11 23H2: builds before 10.0.22631.7711
- Windows 11 24H2: builds before 10.0.26100.9974
- Windows 11 25H2: builds before 10.0.26200.9974
- Windows 11 26H1: builds before 10.0.28000.3501
- Windows 11 26H2: builds before 10.0.26300.9974
- Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
- Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
- Windows Server 2022: builds before 10.0.20348.5870
Fixed in
- Install the November 2026 security update from Microsoft, which contains the fixed builds listed above.
- Verify the fixed builds on the MSRC page before deployment, as the fix details were taken from the CVE record and third-party mirrors.
Workaround
Unknown. No vendor-documented workaround.
- General measure until patched: block inbound TCP 445 at the perimeter and restrict SMB to required internal network segments.
Exploitation
- VulDB states that no exploit exists and technical details are unknown.
- No public proof of concept and no in-the-wild exploitation known at the time of analysis.
Our recommendation
- Patch affected systems with the November 2026 cumulative update, starting with file servers and internet-facing or flat-network servers.
- Block inbound TCP 445 and review internal SMB exposure.
- Watch for an NVD analysis, a KEV listing or a public proof of concept, and re-check the status in one to two weeks.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Windows SMB
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-119988 msrc.microsoft.com
- CVE Record CVE-2026-119988 (CVE.org) www.cve.org
- VulDB entry 434302 vuldb.com
- Senserva: KB5132061 (third-party, unconfirmed fix mapping) senserva.com
- Strix CVE mirror CVE-2026-119988 (third-party) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:12.
Original description (NVD)
Numeric truncation error in Windows SMB allows an authorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.