{"id":"CVE-2026-118126","kind":"vulnerability","aliases":["CVE-2026-118126"],"related":[],"title":"Windows Message Queuing: use-after-free lets local user gain higher privileges","description":"Use after free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in Windows Message Queuing lets an attacker who already has a local account raise their privileges. The sources give no more detail on the exact trigger.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 / Server 2016 (1607)","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","msmq","windows"],"not_affected_if":["msmq-not-installed"],"how_to_check":"1) Is MSMQ installed? PowerShell: Get-WindowsOptionalFeature -Online -FeatureName MSMQ-Server (Server: Get-WindowsFeature MSMQ), or check whether the 'Message Queuing' service (msmq) exists. 2) Get the build: winver or [System.Environment]::OSVersion.Version, and compare with the fixed builds in the fix field. Older than the fixed build with MSMQ installed means exposed.","fix":"Install the November 2026 Windows cumulative update that raises your build to at least: Win10 1607/Server 2016 10.0.14393.9688; Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. Build numbers come from the Microsoft CVE record as mirrored by OpenCVE; confirm the KB in the Security Update Guide.","status":"open","published_at":"2026-11-10T19:19:31+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","triaged_at":"2026-11-10T19:40:47+00:00","updated_at":"2026-11-10T23:25:45+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:40:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Message Queuing: use-after-free lets local user gain higher privileges","impact":"high","summary":"A use-after-free bug in Windows Message Queuing lets an attacker who already has a local account raise their privileges. The sources give no more detail on the exact trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","msmq"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-118126 to confirm affected Windows builds, fixed updates and whether MSMQ must be enabled.","how_to_check":"- Check whether the Message Queuing (MSMQ) Windows feature is installed, for example in Server Manager or Settings > Optional features\n- Confirm the Windows build against Microsoft's update history for this CVE, which the sources do not list","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["msmq-not-installed"],"who_is_affected":"Windows machines where the Message Queuing component is present and an authorized local user exists; the sources do not say which Windows versions or configurations are affected. Machines without Message Queuing installed are likely not exposed, but the sources do not confirm this. Single-user machines without untrusted local accounts carry less risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":4480,"output_tokens":534,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-118126 to confirm affected Windows builds, fixed updates and whether MSMQ must be enabled.","search":"'-118126':16A,19A '-2026':15A,18A '10':21A,26A,31A,34A '11':37A,40A,43A,46A,49A '1607':24A '1809':27A '2016':23A '2019':29A '2022':53A '2025':56A '21h2':32A '22h2':35A '23h2':38A '24h2':41A '25h2':44A '26h1':47A '26h2':50A 'account':82B 'allow':103C 'alreadi':78B 'attack':76B,106C 'author':105C 'bug':69B 'cve':14A,17A 'detail':91B 'elev':108C 'escal':61B 'exact':94B 'free':7A,68B,98C 'gain':11A 'give':88B 'higher':12A 'infrastructur':57B 'let':8A,74B 'local':9A,59B,81B,110C 'local-privilege-escal':58B 'messag':2A,72B,101C 'msmq':62B 'privileg':13A,60B,85B,109C 'queu':3A,73B,102C 'rais':83B 'server':22A,28A,52A,55A 'sourc':87B 'trigger':95B 'use':5A,66B,96C 'use-after-fre':4A,65B 'user':10A 'window':1A,63B,71B,100C 'windows':20A,25A,30A,33A,36A,39A,42A,45A,48A,51A,54A","nicknames":[],"mitigations":[],"who_affected":"Windows 10, Windows 11 and Windows Server 2016/2019/2022/2025 machines older than the November 2026 update. The bug is in Message Queuing, so check servers and workstations that have the MSMQ feature installed, mainly multi-user servers and machines where untrusted code or users can run locally. Machines without MSMQ are probably not exposed, but the sources read do not state that MSMQ must be enabled.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101809server2019","1021h2","1022h2","10server20161607","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101809server2019","windows1021h2","windows1022h2","windows10server20161607","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","msmq","windows"],"campaign_type":null,"search_a":"'-118126':16A,19A '-2026':15A,18A '10':21A,26A,31A,34A '11':37A,40A,43A,46A,49A '1607':24A '1809':27A '2016':23A '2019':29A '2022':53A '2025':56A '21h2':32A '22h2':35A '23h2':38A '24h2':41A '25h2':44A '26h1':47A '26h2':50A 'cve':14A,17A 'free':7A 'gain':11A 'higher':12A 'let':8A 'local':9A 'messag':2A 'privileg':13A 'queu':3A 'server':22A,28A,52A,55A 'use':5A 'use-after-fre':4A 'user':10A 'window':1A 'windows':20A,25A,30A,33A,36A,39A,42A,45A,48A,51A,54A","search_b":"'account':82B 'alreadi':78B 'attack':76B 'bug':69B 'detail':91B 'escal':61B 'exact':94B 'free':68B 'give':88B 'infrastructur':57B 'let':74B 'local':59B,81B 'local-privilege-escal':58B 'messag':72B 'msmq':62B 'privileg':60B,85B 'queu':73B 'rais':83B 'sourc':87B 'trigger':95B 'use':66B 'use-after-fre':65B 'window':63B,71B","search_c":"'allow':103C 'attack':106C 'author':105C 'elev':108C 'free':98C 'local':110C 'messag':101C 'privileg':109C 'queu':102C 'use':96C 'window':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118126","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118126","severity":null,"published_at":"2026-11-10T19:19:31+00:00","modified_at":"2026-11-10T19:19:32+00:00","first_seen_at":"2026-11-10T19:24:48+00:00","fetched_at":"2026-11-10T19:24:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118126:3166","url":"https://app.opencve.io/cve/CVE-2026-118126","severity":null,"published_at":"2026-11-10T23:25:45+00:00","modified_at":"2026-11-10T23:25:45+00:00","first_seen_at":"2026-11-10T23:25:45+00:00","fetched_at":"2026-11-10T23:25:45+00:00","note":"MSRC page is JS-only and unreadable here; affected/fixed builds taken from the Microsoft CNA record via OpenCVE (not primary page), so nothing marked verified. CVSS 7.8, AV:L PR:L, CWE-416, exploit maturity E:U (unproven) in the record; no exploitation or PoC seen. MSMQ-must-be-enabled not confirmed. Revisit when MSRC KB links are readable.","cites":["https://app.opencve.io/cve/CVE-2026-118126"]}],"documents":[{"id":120156,"url":"https://app.opencve.io/cve/CVE-2026-118126","title":"OpenCVE: CVE-2026-118126 (mirrors Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}