CVE-2026-118144

MediumCVSS 6.6/10Last modified Nov 10, 2026

Description

Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges with a physical attack.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1181457.5Use after free in Windows Function Discovery SSDP Provider allows an unauthorized attacker to execute code over an adjacent network.CVE-2026-1181468.8Incorrect authorization in Active Directory Domain Services allows an authorized attacker to execute code over a network.CVE-2026-1181477.4Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.CVE-2026-1181487.5Improper authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.CVE-2026-1181498.8Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an authorized attacker to execute code over a CVE-2026-118155.3An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize CVE-2026-1181508.8Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a netCVE-2026-1181517.2External control of file name or path in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-1181526.5Cross-site request forgery (csrf) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.CVE-2026-1181537.5Inefficient algorithmic complexity in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.CVE-2026-1181548.8Reliance on untrusted inputs in a security decision in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a CVE-2026-1181577.2Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-118144: Medium severity, CVSS 6.6 | Vulnix