CVE-2026-118144ImportantEoPPhysical

Windows Smart Card Elevation of Privilege Vulnerability

MSRC advisory NVD CVE.org

Assessment

Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges with a physical attack.

Severity: Important
CVSS base score: 6.6
Impact: Elevation of Privilege
Exploitation detected: No known exploitation (MSRC assessment)
Exploitability: Exploitation Less Likely
Publicly disclosed: No (MSRC assessment)
EPSS · 30-day forecast: No EPSS score collected
Customer action: Required: follow the MSRC remediation guidance

More details

CVSS vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Public detection template: No Nuclei template is listed in the current collected catalog
Component: Windows Smart Card
Weakness: CWE-122: Heap-based Buffer Overflow
Issued by: Microsoft
Published: 10 Nov 2026 · November 2026
Last revised: 10 Nov 2026

CVSS 3.1 base metricsRed raises the risk · green lowers it

Attack vector: PhysicalAV:P
Attack complexity: LowAC:L
Privileges required: LowPR:L
User interaction: NoneUI:N
Scope: UnchangedS:U
Confidentiality: HighC:H
Integrity: HighI:H
Availability: HighA:H

Updates that fix it

10 KBs

KB	Type	Restart	Applies to	Other CVEs
KB5131077	Security Update	—	Windows Server 2025, Windows Server 2025 (Server Core installation)	All CVEs in KB5131077
KB5131080	Security Update	Required	Windows Server 2025, Windows Server 2025 (Server Core installation)	All CVEs in KB5131080
KB5131085	Security Update	Required	Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019 and 1 more	All CVEs in KB5131085
KB5131087	Security Update	Required	Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems	All CVEs in KB5131087
KB5131090	Security Update	Required	Windows Server 2022, Windows Server 2022 (Server Core installation)	All CVEs in KB5131090
KB5131096	Security Update	Required	Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems and 3 more	All CVEs in KB5131096
KB5131291	Security Update	Required	Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows Server 2016 and 1 more	All CVEs in KB5131291
KB5132043	Security Update	—	Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems and 3 more	All CVEs in KB5132043
KB5132059	Security Update	Required	Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems	All CVEs in KB5132059
KB5132061	Security Update	Required	Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems and 3 more	All CVEs in KB5132061

Affected products

ESU, Windows

28 affected products

Page history

Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.

Cite this version

Field-level log (0)

Up to 100 recent field edits are shown; older edits may be outside retention.

No retained field changes for this selection.