CVE-2026-118138

HighCVSS 7.8/10Last modified Nov 10, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Client for NFS allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362CWE-822

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-118146.8A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify lCVE-2026-1181405.5Improper access control in Windows Server for NFS allows an authorized attacker to disclose information locally.CVE-2026-1181418.8Stack-based buffer overflow in Windows Client for NFS allows an unauthorized attacker to execute code over a network.CVE-2026-1181427.8Out-of-bounds read in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges locally.CVE-2026-1181436.8Out-of-bounds read in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1181446.6Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges with a physical attack.CVE-2026-1181457.5Use after free in Windows Function Discovery SSDP Provider allows an unauthorized attacker to execute code over an adjacent network.CVE-2026-1181468.8Incorrect authorization in Active Directory Domain Services allows an authorized attacker to execute code over a network.CVE-2026-1181477.4Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.CVE-2026-1181487.5Improper authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.CVE-2026-1181498.8Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an authorized attacker to execute code over a CVE-2026-118155.3An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize
CVE-2026-118138: High severity, CVSS 7.8 | Vulnix