{"id":"CVE-2026-116928","published":"2026-11-10T19:19:21.287","lastModified":"2026-11-11T05:19:26.693","description":"Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-787"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-116928","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical out-of-bounds write vulnerability (CWE-787) exists in Microsoft Windows Search Component, allowing remote code execution without authentication over the network.","exploitability":"Exploitation is highly likely due to network accessibility (AV:N), low attack complexity (AC:L), and no required privileges or user interaction (PR:N, UI:N).","blast_radius":"Successful exploitation could enable full system compromise—including data theft, malware deployment, and lateral movement—across any affected Windows systems with the vulnerable search component enabled.","remediation":"Apply Microsoft security update MS26-XXXX (specific patch level not published in description); until then, disable Windows Search service if non-essential or restrict network exposure of SMB/HTTP endpoints used by the search component per Microsoft advisory.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","cve-2026-116928","windows","search-component","out-of-bounds-write"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:50:39.317Z"}}