High 8.8

Windows ネットワーク接続デバイス自動セットアップサービスに隣接ネットワークから任意のコードを実行される脆弱性

CVE-2026-125136 First seen on SecPulse 03:21

Summary

Windows ネットワーク接続デバイス自動セットアップサービスのヒープベースのバッファオーバーフローにより、同じ隣接ネットワーク上の認証されていない攻撃者にコードを実行される可能性があります。CVSSは8.8です。Windows 10 Version 1607・1809・21H2・22H2、Windows 11 Version 23H2・24H2が対象で、各版の修正版が公開されています。速やかに該当版へ修正版を適用してください。

AI summary

Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
Microsoft	MicrosoftWindows 10 Version 1607	≥ 10.0.14393.0, < 10.0.14393.9688→ 10.0.14393.9688	10.0.14393.9688
Microsoft	MicrosoftWindows 10 Version 1809	≥ 10.0.17763.0, < 10.0.17763.9487→ 10.0.17763.9487	10.0.17763.9487
Microsoft	MicrosoftWindows 10 Version 21H2	≥ 10.0.19044.0, < 10.0.19044.7846→ 10.0.19044.7846	10.0.19044.7846
Microsoft	MicrosoftWindows 10 Version 22H2	≥ 10.0.19045.0, < 10.0.19045.7846→ 10.0.19045.7846	10.0.19045.7846
Microsoft	MicrosoftWindows 11 Version 23H2	≥ 10.0.22631.0, < 10.0.22631.7711→ 10.0.22631.7711	10.0.22631.7711
Microsoft	MicrosoftWindows 11 Version 24H2	≥ 10.0.26100.0, < 10.0.26100.9974→ 10.0.26100.9974	10.0.26100.9974
Microsoft	MicrosoftWindows 11 Version 25H2	≥ 10.0.26200.0, < 10.0.26200.9974→ 10.0.26200.9974	10.0.26200.9974
Microsoft	MicrosoftWindows 11 version 26H1	≥ 10.0.28000.0, < 10.0.28000.3501→ 10.0.28000.3501	10.0.28000.3501
Microsoft	MicrosoftWindows 11 Version 26H2	≥ 10.0.26300.0, < 10.0.26300.9974→ 10.0.26300.9974	10.0.26300.9974

Original description The description as published by the source.

Heap-based buffer overflow in Windows Network Connected Devices Auto-Setup Service allows an unauthorized attacker to execute code over an adjacent network.

Source: Microsoft Security Response Center Blog NVD GitHub Advisory

References

Key facts

CVSS v3: High 8.8; CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Nov 11, 2026
First seen on SecPulse: 03:21
GHSA: GHSA-2f2w-r76w-3vpq
CWE: CWE-122

NVD GitHub Advisory

Tags(click for explanation)

Vendors

Microsoft

All

Msrc Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows 11 Version 23H2 Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows 11 Version 26H2

Attack Types

Remote Code Execution

CWE

CWE-122

Detection sources

NIST National Vulnerability Database06:19
GitHub Security Advisories (Global)06:33
Microsoft Security Response Center Blog03:21
CVE.org (CVE Program・cvelistV5)08:53