---
id: "CVE-2026-112790"
page: "https://infrastack.ai/live/CVE-2026-112790"
kind: "vulnerability"
aliases: ["CVE-2026-112790"]
title: "Windows Kernel: use-after-free lets a local user gain higher privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 11 26H2", "fixed": ["10.0.26300.9974"], "affected": ">= 10.0.26300.0, < 10.0.26300.9974", "ecosystem": "vendor"}, {"name": "Windows 11 26H1", "fixed": ["10.0.28000.3501"], "affected": ">= 10.0.28000.0, < 10.0.28000.3501", "ecosystem": "vendor"}, {"name": "Windows Server 2019", "fixed": ["10.0.17763.9487"], "affected": ">= 10.0.17763.0, < 10.0.17763.9487", "ecosystem": "vendor"}]
ecosystems: []
tags: ["endpoints", "infrastructure", "kernel", "local", "privilege-escalation", "windows"]
not_affected_if: ["no-local-untrusted-users"]
published_at: "2026-11-10T19:18:40+00:00"
first_seen_at: "2026-11-10T19:24:32+00:00"
updated_at: "2026-11-11T00:09:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112790", "first_seen_at": "2026-11-10T19:24:32+00:00"}, {"source": "analyst", "url": "https://tri.opswat.com/vulnerabilities/CVE-2026-112790", "first_seen_at": "2026-11-11T00:09:35+00:00", "cites": ["https://tri.opswat.com/vulnerabilities/CVE-2026-112790"]}]
exploit_sources: []
---

# Windows Kernel: use-after-free lets a local user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-112790 (this .md is for agents)

A use-after-free (CWE-416) in the Windows kernel lets someone who already has a low-privilege local account raise their privileges. Microsoft shipped it in the November 2026 Patch Tuesday release. It is not known to be exploited and no public PoC was found. Exploitation is rated high complexity.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows 11 26H2 affected >= 10.0.26300.0, < 10.0.26300.9974 fixed 10.0.26300.9974
- vendor:Windows 11 26H1 affected >= 10.0.28000.0, < 10.0.28000.3501 fixed 10.0.28000.3501
- vendor:Windows Server 2019 affected >= 10.0.17763.0, < 10.0.17763.9487 fixed 10.0.17763.9487

## How to check

Run winver or [System.Environment]::OSVersion and compare the OS build (e.g. 10.0.26300.x, 10.0.28000.x, 10.0.17763.x) with the fixed build for your edition in the Microsoft Security Update Guide entry for CVE-2026-112790. Per aggregated MSRC data you are exposed on Windows 11 26H2 below 10.0.26300.9974, Windows 11 26H1 below 10.0.28000.3501, or Windows Server 2019 below 10.0.17763.9487. Other editions are on the MSRC page. Get-HotFix lists installed updates.

## Fix

Install the November 2026 (2026-Nov) Windows cumulative update for your edition. Builds at or above 10.0.26300.9974 (26H2), 10.0.28000.3501 (26H1) and 10.0.17763.9487 (Server 2019) are fixed according to aggregated MSRC data; KB numbers not read.

## Timeline

- 2026-11-10T19:24:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112790
- 2026-11-11T00:09:35+00:00 analyst https://tri.opswat.com/vulnerabilities/CVE-2026-112790 — MSRC update guide page is JS-only and unreadable here; MSRC CVRF API gave only that it ships in the 2026-Nov release. Builds below come from an aggregator (OPSWAT) repeating MSRC data, which lists 25 products but showed only 3 rows; nothing verified. CVSS 7.0 AV:L/AC:H/PR:L, E:U (exploitation unproven), no PoC found.

## Documents

- [mentions] CVE-2026-112790 - MetaDefender Tri (aggregator of MSRC data) https://tri.opswat.com/vulnerabilities/CVE-2026-112790

## From the sources

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_