WebSAM WinShare CVE-2026-113364

Exploitation requires network reachability to the WebSAM WinShare data-receiving service on an affected Windows host running Ver 7.5.0 or earlier, Ver 7.6.0, or Ver 7.7.0 through 7.7.2; the attacker sends a single crafted packet whose protocol-header data-size field is malformed (oversized) to trigger the heap overflow. Per the CVSS vector (PR:N/UI:N/AT:N/AC:L) no authentication, no user interaction, and no special attack preconditions are needed against the exposed service. The primary limiting factor is exposure: the affected service/port must be network-accessible to the attacker, so hosts where WinShare is firewalled or not internet-facing are correspondingly harder to reach; the product's limited deployment footprint also constrains the realistic target population.

This is a genuine high-priority issue, not an inflated-CVSS case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) describes remote, network-reachable, low-complexity exploitation with no attack requirements, no privileges, and no user interaction, yielding full confidentiality, integrity, and availability loss - and the description confirms the payoff is arbitrary code execution at SYSTEM. The vuln.today decision label is act_now, which aligns with the severe technical impact. However, the corroborating exploitation signals are weak or absent: no CISA KEV listing, no POC/exploit reference, and no EPSS score are provided in the input, so there is currently no evidence of active or imminent exploitation despite the critical severity. The vector and the description agree (both point to remote unauthenticated network attack), so there is no AV conflict to flag. Net: treat as urgent to patch on severity and the act_now label, while recognizing the real-world exploitation likelihood is unquantified here because EPSS is missing and no public exploit is known.

A remote, unauthenticated attacker sends a crafted packet to the WebSAM WinShare service in which the protocol header carries a malformed (oversized) data size value, overflowing a heap buffer in the data-receiving routine. By shaping the packet the attacker achieves arbitrary code execution in the context of the service, which runs with SYSTEM privileges. No public exploit code is identified at time of analysis, so this scenario is inferred from the vulnerability description rather than a verified PoC.