{"id":"CVE-2026-113819","kind":"vulnerability","aliases":["CVE-2026-113819"],"related":[],"title":"Windows Desktop Window Manager: use-after-free lets a local user gain privileges","description":"Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","summary":"Use-after-free (CWE-416) in Windows Desktop Window Manager lets a local user with a low-privilege account gain higher privileges (CVSS 7.0, high attack complexity). Published 2026-11-10. No exploitation or public PoC found.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["desktop-window-manager","infrastructure","local-privilege-escalation","windows","windows-11","windows-server-2025"],"not_affected_if":["no-local-accounts"],"how_to_check":"Run winver or [Environment]::OSVersion and compare the build to the fixed builds: Win 11 24H2 < 10.0.26100.9974, 25H2 < 10.0.26200.9974, 26H1 < 10.0.28000.3501, 26H2 < 10.0.26300.9974, Server 2025 < 10.0.26100.33822. Confirm against the MSRC page.","fix":"Install the November 2026 Windows cumulative update that brings the build to the fixed version for your release (see how-to-check). KB numbers not confirmed.","status":"open","published_at":"2026-11-10T19:19:01+00:00","first_seen_at":"2026-11-10T19:24:41+00:00","triaged_at":"2026-11-10T19:52:13+00:00","updated_at":"2026-11-10T23:52:46+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:52:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Desktop Window Manager: use-after-free lets a local user gain privileges","impact":"high","summary":"A use-after-free bug in Windows Desktop Window Manager lets an attacker who already has a local account raise their privileges. The source does not state what product versions are affected.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","desktop-window-manager"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the affected Windows builds and the Microsoft security update in the NVD entry or the Microsoft Security Response Center advisory for CVE-2026-113819.","how_to_check":"unknown","plain_action":"","product_name":"Windows Desktop Window Manager","needs_analyst":true,"not_affected_if":["no-local-accounts"],"who_is_affected":"Only a local user who is already authorized on the machine can use this flaw, so it is not a remote entry point. The sources do not list affected Windows builds, so unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000673,"input_tokens":4480,"output_tokens":449,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and the Microsoft security update in the NVD entry or the Microsoft Security Response Center advisory for CVE-2026-113819.","search":"'-10':84B '-11':47B,83B '-113819':17A,20A '-2026':16A,19A '-416':57B '11':22A,25A,28A,31A '2025':35A,51B '2026':82B '24h2':23A '25h2':26A '26h1':29A '26h2':32A '7.0':77B 'account':72B 'allow':98C 'attack':79B,101C 'author':100C 'complex':80B 'cve':15A,18A 'cvss':76B 'cwe':56B 'desktop':2A,37B,60B,95C 'desktop-window-manag':36B 'elev':103C 'escal':44B 'exploit':86B 'found':90B 'free':8A,55B,93C 'gain':13A,73B 'high':78B 'higher':74B 'infrastructur':40B 'let':9A,63B 'local':11A,42B,65B,105C 'local-privilege-escal':41B 'low':70B 'low-privileg':69B 'manag':4A,39B,62B,97C 'poc':89B 'privileg':14A,43B,71B,75B,104C 'public':88B 'publish':81B 'server':34A,50B 'use':6A,53B,91C 'use-after-fre':5A,52B 'user':12A,66B 'window':1A,3A,38B,45B,46B,49B,59B,61B,96C 'windows':21A,24A,27A,30A,33A 'windows-serv':48B","nicknames":[],"mitigations":[],"who_affected":"Windows 11 24H2, 25H2, 26H1, 26H2 and Windows Server 2025 (including Server Core) below the fixed builds. An attacker needs an existing local account, so multi-user machines, terminal/RDS servers and shared workstations matter most. Single-user machines with trusted users are lower priority; Windows 10 and older servers are not listed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["1124h2","1125h2","1126h1","1126h2","server2025","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2025"],"ptokens":["11","2025","24h2","25h2","26h1","26h2","server","windows"],"labels":["desktopwindowmanager","high","infrastructure","localprivilegeescalation","windows","windows11","windowsserver2025"],"campaign_type":null,"search_a":"'-113819':17A,20A '-2026':16A,19A '11':22A,25A,28A,31A '2025':35A '24h2':23A '25h2':26A '26h1':29A '26h2':32A 'cve':15A,18A 'desktop':2A 'free':8A 'gain':13A 'let':9A 'local':11A 'manag':4A 'privileg':14A 'server':34A 'use':6A 'use-after-fre':5A 'user':12A 'window':1A,3A 'windows':21A,24A,27A,30A,33A","search_b":"'-10':84B '-11':47B,83B '-416':57B '2025':51B '2026':82B '7.0':77B 'account':72B 'attack':79B 'complex':80B 'cvss':76B 'cwe':56B 'desktop':37B,60B 'desktop-window-manag':36B 'escal':44B 'exploit':86B 'found':90B 'free':55B 'gain':73B 'high':78B 'higher':74B 'infrastructur':40B 'let':63B 'local':42B,65B 'local-privilege-escal':41B 'low':70B 'low-privileg':69B 'manag':39B,62B 'poc':89B 'privileg':43B,71B,75B 'public':88B 'publish':81B 'server':50B 'use':53B 'use-after-fre':52B 'user':66B 'window':38B,45B,46B,49B,59B,61B 'windows-serv':48B","search_c":"'allow':98C 'attack':101C 'author':100C 'desktop':95C 'elev':103C 'free':93C 'local':105C 'manag':97C 'privileg':104C 'use':91C 'window':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113819","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113819","severity":null,"published_at":"2026-11-10T19:19:01+00:00","modified_at":"2026-11-10T19:19:02+00:00","first_seen_at":"2026-11-10T19:24:41+00:00","fetched_at":"2026-11-10T19:24:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113819:3245","url":"https://app.opencve.io/cve/CVE-2026-113819","severity":null,"published_at":"2026-11-10T23:52:46+00:00","modified_at":"2026-11-10T23:52:46+00:00","first_seen_at":"2026-11-10T23:52:46+00:00","fetched_at":"2026-11-10T23:52:46+00:00","note":"MSRC page is JS-only and unreadable here; build ranges taken from OpenCVE mirror of Microsoft CVE record (not primary), so nothing verified. Not exploited per KEV/CVSS E:U; no PoC found.","cites":["https://app.opencve.io/cve/CVE-2026-113819","https://www.rapid7.com/db/vulnerabilities/cve-2026-113819/"]}],"documents":[{"id":120482,"url":"https://app.opencve.io/cve/CVE-2026-113819","title":"OpenCVE: CVE-2026-113819 (mirrors Microsoft CVE record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120483,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-113819/","title":"Rapid7 DB: CVE-2026-113819","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}