CVE-2026-112973

HighCVSS 7.1/10Last modified Nov 10, 2026

Description

Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1129745.5Improper access control in Microsoft Account allows an authorized attacker to perform tampering locally.CVE-2026-1129755.3Untrusted pointer dereference in Windows Link-Layer Discovery Protocol (LLDP) allows an unauthorized attacker to deny service over an adjaceCVE-2026-1129767.0Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.CVE-2026-1129775.5Improper privilege management in Windows Deployment Services allows an authorized attacker to disclose information locally.CVE-2026-1129787.8Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.CVE-2026-1129795.5Weak authentication in Windows State Repository Service allows an authorized attacker to perform tampering locally.CVE-2026-112984.3Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass same origiCVE-2026-1129806.7Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.CVE-2026-1129817.8Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.CVE-2026-1129825.5Missing authentication for critical function in Microsoft Account allows an authorized attacker to perform tampering locally.CVE-2026-1129846.6Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.CVE-2026-1129857.5Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network.
CVE-2026-112973: High severity, CVSS 7.1 | Vulnix