CVE-2026-113364

CriticalCVSS 9.3/10Last modified Nov 12, 2026

Description

Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header.

Metrics

CVSS 4.0 9.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-122

Affected software

Vendor	Product	Versions
NEC Corporation	WebSAM WinShare	Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2

References

https://jpn.nec.com/security-info/secinfo/nv26-006_en.html

Timeline

Published: Nov 9, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1133685.4Sonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the repository is added as a memb CVE-2026-1133696.3Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit per CVE-2026-113374.3A vulnerability was found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500 CVE-2026-1133707.7Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds CVE-2026-1133717.1Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account CVE-2026-1133727.1Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privil CVE-2026-1133738.1Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Conn CVE-2026-1133748.6Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds onl CVE-2026-1133785.3A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the com CVE-2026-113382.4A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System 1.0. Impacted is an unknown function of th CVE-2026-1133809.3In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup t CVE-2026-1133817.3A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-inc