CVE-2026-112970: Windows SMB Client Elevation of Privilege Vulnerability

Q: Who can exploit this vulnerability?

An attacker must already be authorized on the affected Windows 11 system and able to execute an attack locally. The available data does not indicate that remote or unauthenticated exploitation is possible.

Q: What level of impact could successful exploitation have?

Successful exploitation can allow local privilege elevation. The supplied vector indicates high potential impact to confidentiality, integrity, and availability.

Q: Is exploitation expected to be straightforward?

No. The supplied vector rates attack complexity as high, indicating exploitation requires conditions or techniques that make it more difficult than a low-complexity attack.

Published Nov 10, 2026

Updated

Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.

Other sources

Windows SMB Client Elevation of Privilege Vulnerability

— Microsoft

Affected Software

2 affected componentsFixes available

Microsoft Windows 11=26H1, >=10.0.28000<10.0.28000.3501

10.0.28000.3501

Microsoft Windows 11=26H1, >=10.0.28000<10.0.28000.3501

10.0.28000.3501

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3501Patch KB5132059

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:18 PM

Data Sourced

via MITRE·06:18 PM

DescriptionSeverity

Data Sourced

via NVD·07:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must already be authorized on the affected Windows 11 system and able to execute an attack locally. The available data does not indicate that remote or unauthenticated exploitation is possible.

What level of impact could successful exploitation have?

Successful exploitation can allow local privilege elevation. The supplied vector indicates high potential impact to confidentiality, integrity, and availability.

Is exploitation expected to be straightforward?

No. The supplied vector rates attack complexity as high, indicating exploitation requires conditions or techniques that make it more difficult than a low-complexity attack.

CVE-2026-112970: Windows SMB Client Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What level of impact could successful exploitation have?

Is exploitation expected to be straightforward?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What level of impact could successful exploitation have?

Is exploitation expected to be straightforward?