First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-116706

HighCVSS 7.5/10Last modified Nov 10, 2026

Description

Use after free in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over an adjacent network.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Microsoft	Windows 10 Version 1607	>= 10.0.14393.0, < 10.0.14393.9688
Microsoft	Windows 10 Version 1809	>= 10.0.17763.0, < 10.0.17763.9487
Microsoft	Windows 10 Version 21H2	>= 10.0.19044.0, < 10.0.19044.7846
Microsoft	Windows 10 Version 22H2	>= 10.0.19045.0, < 10.0.19045.7846
Microsoft	Windows 11 version 23H2	>= 10.0.22631.0, < 10.0.22631.7711
Microsoft	Windows 11 Version 23H2	>= 10.0.22631.0, < 10.0.22631.7711
Microsoft	Windows 11 Version 24H2	>= 10.0.26100.0, < 10.0.26100.9974
Microsoft	Windows 11 Version 25H2	>= 10.0.26200.0, < 10.0.26200.9974
Microsoft	Windows 11 version 26H1	>= 10.0.28000.0, < 10.0.28000.3501
Microsoft	Windows 11 Version 26H2	>= 10.0.26300.0, < 10.0.26300.9974
Microsoft	Windows Server 2016	>= 10.0.14393.0, < 10.0.14393.9688
Microsoft	Windows Server 2016 (Server Core installation)	>= 10.0.14393.0, < 10.0.14393.9688
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.9487
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.17763.0, < 10.0.17763.9487
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.5870
Microsoft	Windows Server 2025	>= 10.0.26100.0, < 10.0.26100.33822
Microsoft	Windows Server 2025 (Server Core installation)	>= 10.0.26100.0, < 10.0.26100.33822

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-116706

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1167077.0Use after free in Windows Link Layer Topology Discovery Protocol allows an authorized attacker to elevate privileges locally.CVE-2026-116719.6Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via CVE-2026-1167108.1Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network.CVE-2026-1167147.8Incorrect authorization in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.CVE-2026-1167178.8Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.CVE-2026-1167187.5Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1167198.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-116728.3Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer p CVE-2026-1167208.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1167216.5Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.CVE-2026-1167228.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-1167237.8FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack

CVE-2026-116706: High severity, CVSS 7.5 | Vulnix