critical · CVSS v3 9.8 · CVSS v4 9.3

CVE-2026-113364

NEC WebSAM WinShare on Windows has a critical buffer overflow that allows a remote unauthenticated attacker to execute code with SYSTEM priv

Overview

NEC WebSAM WinShare on Windows has a critical buffer overflow that allows a remote unauthenticated attacker to execute code with SYSTEM privileges. The flaw exists in versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2. It can be triggered by sending a crafted packet with a malformed data size value in the protocol header.

Description

Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header.

Impact

The vulnerability compromises confidentiality, integrity, and availability of the affected systems. Attackers can gain full SYSTEM privileges, enabling them to exfiltrate data, tamper with configurations, or disrupt services. Administrators and network operators are the primary stakeholders who must address this risk.

Remediation

Apply the vendor‑issued security patch for the affected WinShare versions or upgrade to a newer release that eliminates the buffer overflow. If patching is not immediately possible, restrict inbound traffic to the WinShare service using firewalls or ACLs, disable unused protocols, and enable Windows security features such as ASLR, DEP, and stack canaries. Monitor logs for anomalous packet sizes and conduct regular vulnerability scans.

Risk context

The CVSS v3 score of 9.8 and critical severity indicate a high‑risk flaw with immediate impact. No EPSS data is available, but the lack of a patch or mitigation increases the urgency for defenders to act promptly.

Affected products

  • NEC WebSAM WinShare 7.5
  • NEC WebSAM WinShare 7.6
  • NEC WebSAM WinShare 7.7

Scores

Severity
critical
CVSS v2
10
CVSS v3
9.8
CVSS v4
9.3
EPSS
—

buffer overflow remote code execution NEC WinShare critical system privilege escalation Windows

← All CVEs

Related CVEs

critical

CVE-2026-119506

Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.

View analysis

critical

CVE-2026-124560

A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

View analysis

critical

CVE-2026-113363

NEC WebSAM WinShare versions 7.2.0-7.5.0, 7.6.0, and 7.7.0-7.7.2 on Windows contain an input validation flaw that allows a remote unauthenticated attacker to send a crafted packet and execute arbitrary commands with SYSTEM privileges. The vulnerability can compromise the entire host and expose sensitive data. It affects organizations using these WinShare versions.

View analysis

critical

CVE-2026-115213

The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site.

View analysis