CVE-2026-113364
CriticalCVSS 9.3Summary
Buffer overflow in the data receiving process in NEC WebSAM WinShare versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header.
Risk Assessment
Critical vulnerability — an unauthenticated attacker can gain full control of the system with SYSTEM privileges, potentially leading to complete compromise of confidentiality, integrity, and availability.
Recommendation
Update WebSAM WinShare to a patched version as soon as possible or apply the vendor-recommended workaround; consider restricting network access to the service to trusted addresses.
Other vulnerabilities in NEC WebSAM WinShare
See all- CVE-2026-113362High
Improper access control in the installation folder of NEC WebSAM Winshare versions 7.5.0 and earlier (excluding 7.3.3), 7.6.0, and 7.7.0 through 7.7.1 on Windows allows a locally authenticated low-privileged attacker to execute arbitrary code with SYSTEM privileges via a crafted DLL loaded by a SYSTEM-level process.
- CVE-2026-113363Critical
Improper input validation in the network communication processing in NEC WebSAM WinShare versions 7.2.0 through 7.5.0, 7.6.0, and 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges via a crafted network packet sent to the computer running WinShare.
Original NVD description (English source)
Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS