{"id":"CVE-2026-119383","kind":"vulnerability","aliases":["CVE-2026-119383"],"related":[],"title":"Windows Smart Card flaw lets local user with physical access gain higher privileges","description":"Use of uninitialized resource in Windows Smart Card allows an authorized attacker to elevate privileges with a physical attack.","summary":"Windows Smart Card components read an uninitialized resource, which can be abused to elevate privileges. An attacker who already has an authorized account and physical access to the machine can gain higher privileges.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Smart Card","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","smart-card","windows"],"not_affected_if":["no-smart-card-use","no-untrusted-local-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:19:52+00:00","first_seen_at":"2026-11-10T19:24:56+00:00","triaged_at":"2026-11-10T19:56:00+00:00","updated_at":"2026-11-10T19:56:00+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:56:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Smart Card flaw lets local user with physical access gain higher privileges","impact":"high","summary":"Windows Smart Card components read an uninitialized resource, which can be abused to elevate privileges. An attacker who already has an authorized account and physical access to the machine can gain higher privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","smart-card"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows machine","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-119383 for affected Windows builds and the patch.","how_to_check":"unknown","plain_action":"","product_name":"Windows Smart Card","needs_analyst":true,"not_affected_if":["no-smart-card-use","no-untrusted-local-users"],"who_is_affected":"Windows machines that use smart card authentication or smart card readers are the likely exposure, and only for users who already hold an account on the machine. Systems without smart card components, or without local untrusted users, have less to worry about. The sources do not name affected Windows builds.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000687,"input_tokens":4496,"output_tokens":475,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119383':16A,19A '-2026':15A,18A 'abus':39B 'access':10A,53B 'account':50B 'allow':69C 'alreadi':46B 'attack':44B,72C,79C 'author':49B,71C 'card':3A,22A,26B,30B,68C 'compon':31B 'cve':14A,17A 'elev':41B,74C 'flaw':4A 'gain':11A,58B 'higher':12A,59B 'infrastructur':23B 'let':5A 'local':6A 'machin':56B 'physic':9A,52B,78C 'privileg':13A,42B,60B,75C 'read':32B 'resourc':35B,64C 'smart':2A,21A,25B,29B,67C 'smart-card':24B 'uniniti':34B,63C 'use':61C 'user':7A 'window':1A,27B,28B,66C 'windows':20A","nicknames":[],"mitigations":[],"who_affected":"Windows machines that use smart card authentication or smart card readers are the likely exposure, and only for users who already hold an account on the machine. Systems without smart card components, or without local untrusted users, have less to worry about. The sources do not name affected Windows builds.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["smartcard","windowssmartcard"],"ptokens":["card","smart","windows"],"labels":["infrastructure","medium","smartcard","vendor","windows"],"campaign_type":null,"search_a":"'-119383':16A,19A '-2026':15A,18A 'access':10A 'card':3A,22A 'cve':14A,17A 'flaw':4A 'gain':11A 'higher':12A 'let':5A 'local':6A 'physic':9A 'privileg':13A 'smart':2A,21A 'user':7A 'window':1A 'windows':20A","search_b":"'abus':39B 'access':53B 'account':50B 'alreadi':46B 'attack':44B 'author':49B 'card':26B,30B 'compon':31B 'elev':41B 'gain':58B 'higher':59B 'infrastructur':23B 'machin':56B 'physic':52B 'privileg':42B,60B 'read':32B 'resourc':35B 'smart':25B,29B 'smart-card':24B 'uniniti':34B 'window':27B,28B","search_c":"'allow':69C 'attack':72C,79C 'author':71C 'card':68C 'elev':74C 'physic':78C 'privileg':75C 'resourc':64C 'smart':67C 'uniniti':63C 'use':61C 'window':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119383","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119383","severity":null,"published_at":"2026-11-10T19:19:52+00:00","modified_at":"2026-11-10T19:19:52+00:00","first_seen_at":"2026-11-10T19:24:56+00:00","fetched_at":"2026-11-10T19:24:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}