Microsoft November patches fix 1,094 bugs, one exploited
CVE-2026-124194 can leak an Outlook user’s NTLMv2 hash; two zero-click remote code execution bugs also ship.
78
CVE-2026-116928
Out-of-bounds write RCE in Windows Search Component
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An out-of-bounds write in the Microsoft Windows Search Component lets an unauthorized attacker run code. The flaw is reachable over the network with no authentication and no user interaction. Successful exploitation gives full control of confidentiality, integrity, and availability on the affected system. Microsoft has not listed affected builds.
What to do: Apply Microsoft's update for CVE-2026-116928. No workaround is stated.
| Product | Affected |
|---|---|
| Microsoft Windows Search Component | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.
- Weakness
- CWE-787
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
2 storiesMicrosoft November patches list 1,094 CVEs; one Outlook flaw exploited
CISA added the exploited Outlook spoofing bug to KEV; a Windows Search flaw is called zero-click code execution.
74