CVE-2026-112809: Windows Composite Image File System Information Disclosure Vulnerability

Q: What level of access does an attacker need to exploit this issue?

The attacker must already be authorized on the affected Windows system and able to execute the attack locally. The available data does not indicate that remote exploitation or user interaction is required.

Q: What is the likely security impact if exploitation succeeds?

Successful exploitation can disclose information from the affected system. The provided severity data indicates high confidentiality impact, with no indicated integrity or availability impact.

Published Nov 10, 2026

Updated

Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally.

Other sources

Windows Composite Image File System Information Disclosure Vulnerability

— Microsoft

Affected Software

2 affected componentsFixes available

Microsoft Windows 11=26H1, >=10.0.28000<10.0.28000.3501

10.0.28000.3501

Microsoft Windows 11=26H1, >=10.0.28000<10.0.28000.3501

10.0.28000.3501

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3501Patch KB5132059

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:18 PM

Data Sourced

via MITRE·06:18 PM

DescriptionSeverity

Data Sourced

via NVD·07:18 PM

DescriptionSeverity

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker must already be authorized on the affected Windows system and able to execute the attack locally. The available data does not indicate that remote exploitation or user interaction is required.

What is the likely security impact if exploitation succeeds?

Successful exploitation can disclose information from the affected system. The provided severity data indicates high confidentiality impact, with no indicated integrity or availability impact.

CVE-2026-112809: Windows Composite Image File System Information Disclosure Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the likely security impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the likely security impact if exploitation succeeds?