CVE-2026-113364 in WebSAM WinShare
Summary
by MITRE • 11/09/2026
Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/09/2026
The vulnerability identified in NEC Corporation WebSAM WinShare versions prior to and including specific releases of version 7.5, 7.6, and 7.7 represents a critical remote code execution flaw rooted in improper input validation within the data receiving mechanism. This buffer overflow occurs when the application processes incoming network packets that contain malformed or excessively large size values embedded directly within the protocol header. Because WebSAM WinShare is designed to accept connections from various endpoints for system monitoring and management, it inherently exposes a broad attack surface over the network. The core technical failure lies in the software's inability to correctly validate the length field of incoming data structures before allocating memory or copying that data into fixed-size buffers on the stack or heap. When an attacker crafts a packet with a deliberately inflated size value, the application attempts to allocate resources based on this untrusted input without performing sufficient bounds checking. This discrepancy between the declared size and the actual buffer capacity leads to a classic buffer overflow condition where excess data overwrites adjacent memory locations containing critical control flow information such as return addresses or function pointers.
From an operational perspective, the impact of this vulnerability is severe due to the privilege level at which WebSAM WinShare typically operates on Windows systems. The service often runs with SYSTEM privileges to facilitate deep system monitoring and configuration changes across managed endpoints. Consequently, a successful exploitation allows a remote unauthenticated attacker to execute arbitrary code within the context of the operating system's highest privileged account. This grants the adversary complete control over the affected host, enabling them to install malware, create new administrative accounts, exfiltrate sensitive data, or pivot further into the internal network. The lack of required authentication significantly lowers the barrier for exploitation, allowing any entity with network connectivity to attempt an attack without needing valid credentials first.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) identifiers such as CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write. The specific behavior also maps to the MITRE ATT&CK framework, particularly under techniques involving Remote Code Execution on Cloud Infrastructure or Local Systems via Exploitation for Privilege Escalation if the initial foothold is gained through other means, though in this case, it serves as a direct entry point. The exploitation vector falls under Network-Based Attack vectors where the attacker sends crafted network packets to trigger the flaw remotely.
Mitigation strategies must prioritize immediate patching by upgrading NEC WebSAM WinShare to a version that addresses these input validation flaws. Until patches are applied, organizations should implement strict network segmentation rules to restrict access to the ports used by WebSAM WinShare services only from trusted management networks or specific administrative IP ranges. Additionally, deploying intrusion detection systems with signatures capable of detecting anomalous packet sizes and malformed protocol headers can help identify and block exploitation attempts in real-time. It is also advisable to disable unnecessary features within the application that expose these network interfaces if they are not actively required for business operations, thereby reducing the overall attack surface available to potential adversaries.