EUVD-2026-73137
GHSA-4qx9-g9wc-38c2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege local session
-
DeliveryInitiate SMB Client connection to crafted server
-
ExploitTrigger heap buffer overflow via malformed SMB response
-
ExecutionCorrupt heap control structures
-
ImpactExecute arbitrary code as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must already hold a low-privilege local account on the affected Windows 11 26H1 system (PR:L per CVSS). The SMB Client component must be exercised - the attacker triggers the flaw by initiating an SMB connection, likely to an attacker-controlled server. The attack is confined to local access (AV:L); remote unauthenticated exploitation across a network is not possible. No non-default configuration is specified as required; any standard Windows 11 26H1 system with an unprivileged user who can initiate SMB sessions is in scope. Builds at or above 10.0.28000.2954 are not affected. |
| Impact | The CVSS 3.1 score of 7.8 with vector AV:L/AC:L/PR:L/UI:N accurately reflects the real-world threat profile: this is a local privilege escalation requiring an authenticated foothold but no special configuration or user interaction. Because attack vector is local, internet-exposed or perimeter-unprotected systems are not directly threatened without a prior compromise stage. No EPSS data was provided, and the absence of a CISA KEV listing and POC suggests exploitation remains theoretical or closely held. Despite these limiting factors, the full C:H/I:H/A:H impact makes this a meaningful post-compromise escalation primitive - even a mid-sized municipal IT department operating in opole should treat this as a priority patch item, since any standard domain user who lands on an affected Windows 11 26H1 workstation could use this to achieve SYSTEM. Patch availability from Microsoft further elevates urgency relative to unpatched local privilege escalation issues. |
| Exploit ScenarioDerived | An attacker who has obtained a low-privilege local session - via phishing, credential theft, or an earlier vulnerability - connects the Windows SMB Client to a crafted or attacker-controlled SMB server. The server returns a malformed response that triggers the heap buffer overflow in the SMB Client, allowing the attacker to corrupt heap structures and redirect execution to attacker-controlled code, achieving SYSTEM-level privileges on the local machine. No public POC is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Privilege escalation in the Windows SMB Client component of Windows 11 26H1 allows a locally authenticated attacker with standard user privileges to gain full SYSTEM-level control via a heap-based buffer overflow (CWE-122). The vulnerability is constrained to local attack vectors, meaning remote unauthenticated exploitation is not possible. Microsoft has released a patch (build 10.0.28000.2954); no public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Apply the Microsoft security update that brings Windows 11 26H1 to build 10.0.28000.2954 or later via Windows Update, WSUS, or Microsoft Update Catalog. The advisory is published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69544. As a compensating control where immediate patching is not feasible, restrict local interactive and remote desktop logon rights to only trusted, named administrative accounts, reducing the attacker pool who can reach the vulnerable code path. Note that blocking outbound SMB traffic (TCP 445) at the host firewall may reduce attack surface from malicious servers but does not eliminate the vulnerability if the client initiates any SMB connection internally.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Windows SMB Client is the kernel- or user-mode component responsible for initiating and handling Server Message Block protocol sessions for network file and printer sharing. CWE-122 (Heap-based Buffer Overflow) indicates that memory allocated on the heap during SMB response processing or session management is overwritten beyond its bounds, corrupting adjacent heap metadata or control structures. Exploitation typically involves directing the SMB client to communicate with a crafted server response or triggering a specific code path during share enumeration or connection negotiation. The affected CPE maps to Windows 11 version 26H1 (build range 10.0.28000.0 through 10.0.28000.2953), as confirmed by EUVD-2026-73137.
Know when Windows 11 26h1 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only vector confirmed by description; PR:L reflects the requirement for a pre-existing authenticated local session; full C/I/A impact consistent with SYSTEM-level privilege escalation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A privilege escalation vulnerability in Windows 11 26H1 SMB Client allows authenticated local users to escalate to SYSTEM administrator privileges through a heap-based buffer overflow. This poses a critical insider threat and credential-compromise risk: any employee or compromised standard user account can seize full system control without administrative approval, dramatically expanding the impact of endpoint breaches. Organizations running Windows 11 26H1 must prioritize remediation to prevent lateral movement and credential-based attacks.
Apply vendor patch (build 10.0.28000.2954). During remediation window: enforce principle of least privilege on SMB shares, restrict standard user access to administrative resources, monitor for privilege escalation events in Windows Security logs, and disable unnecessary SMB protocols where operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Windows 11 26h1
View allCommand injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Remote code execution in Microsoft Windows HTTP.sys allows unauthenticated network attackers to execute arbitrary code b
Privilege elevation in the Windows TCP/IP networking stack allows an unauthenticated attacker on an adjacent network to
Remote code execution in Windows RRAS affects Windows 10 1607 and Windows Server 2022 23h2 through an integer overflow v
Local code execution in Microsoft Windows Win32K GRFX (graphics) subsystem allows an attacker with low-privilege local a
Local code execution in the Windows Win32K GRFX (graphics) subsystem allows an unauthorized attacker with the ability to
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an
Local privilege escalation in Windows Push Notifications enables an authenticated low-privileged user to elevate to high
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) in conc
Exploit-DB