{"id":"CVE-2026-119386","kind":"vulnerability","aliases":["CVE-2026-119386"],"related":[],"title":"Windows ReFS: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free in the Windows Resilient File System (ReFS) lets a local user with a low-privilege account gain higher privileges. Microsoft published it on 10 Nov 2026 (November Patch Tuesday) with CVSS 7.0 (attack complexity high). It is not known to be exploited and no public exploit code was found. Fixed builds are listed for Windows 11; the Server 2022 and 2025 builds are not confirmed.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">= 10.0.22631.0, < 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":">= 10.0.26100.0, < 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":">= 10.0.26200.0, < 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":">= 10.0.28000.0, < 10.0.28000.3501","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":">= 10.0.26300.0, < 10.0.26300.9974","ecosystem":"microsoft"}],"ecosystems":[],"tags":["file-server","infrastructure","local-privilege-escalation","refs","windows","windows-11","windows-server"],"not_affected_if":["no-refs-volumes","no-untrusted-local-users","patched"],"how_to_check":"Run winver or [System.Environment]::OSVersion in PowerShell and compare the build with the fixed builds. Then run Get-Volume | Where FileSystem -eq ReFS to see if any ReFS volume exists. Whether ReFS must be in use for the bug to be reachable is not stated in the sources I read.","fix":"Install the 10 Nov 2026 cumulative update. Fixed Windows 11 builds: 23H2 10.0.22631.7711, 24H2 10.0.26100.9974, 25H2 10.0.26200.9974, 26H1 10.0.28000.3501, 26H2 10.0.26300.9974. Server 2022 and 2025 fixed builds: unknown, not read.","status":"open","published_at":"2026-11-10T19:19:52+00:00","first_seen_at":"2026-11-10T19:24:56+00:00","triaged_at":"2026-11-10T19:52:03+00:00","updated_at":"2026-11-10T22:58:54+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:52:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows ReFS: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in the Windows Resilient File System (ReFS) lets an attacker who already has a local account raise their privileges. Sources do not say which Windows builds are affected or whether a patch exists.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","refs","file-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Find the Microsoft advisory for CVE-2026-119386 to confirm affected Windows builds, fixed update and whether ReFS must be in use.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-refs-volumes","no-untrusted-local-users"],"who_is_affected":"Machines running Windows with ReFS volumes are the relevant systems; the attacker must already have an authorized local account. Sources do not list affected Windows builds. Systems without ReFS volumes or without untrusted local users are likely lower priority.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4492,"output_tokens":457,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-119386 to confirm affected Windows builds, fixed update and whether ReFS must be in use.","search":"'-11':46B '-119386':16A,19A '-2026':15A,18A '10':79B '11':21A,24A,27A,30A,33A,111B '2022':114B '2025':116B '2026':81B '23h2':22A '24h2':25A '25h2':28A '26h1':31A '26h2':34A '7.0':87B 'account':71B 'allow':130C 'attack':88B,133C 'author':132C 'build':106B,117B 'code':102B 'complex':89B 'confirm':120B 'cve':14A,17A 'cvss':86B 'elev':135C 'escal':42B 'exploit':97B,101B 'file':36B,59B,127C 'file-serv':35B 'fix':105B 'found':104B 'free':6A,54B,123C 'gain':11A,72B 'high':90B 'higher':12A,73B 'infrastructur':38B 'known':94B 'let':7A,62B 'list':108B 'local':9A,40B,64B,137C 'local-privilege-escal':39B 'low':69B 'low-privileg':68B 'microsoft':75B 'nov':80B 'novemb':82B 'patch':83B 'privileg':13A,41B,70B,74B,136C 'public':100B 'publish':76B 'ref':2A,43B,61B,129C 'resili':58B,126C 'server':37B,49B,113B 'system':60B,128C 'tuesday':84B 'use':4A,52B,121C 'use-after-fre':3A,51B 'user':10A,65B 'window':1A,44B,45B,48B,57B,110B,125C 'windows':20A,23A,26A,29A,32A 'windows-serv':47B","nicknames":[],"mitigations":[],"who_affected":"Machines running Windows with ReFS volumes are the relevant systems; the attacker must already have an authorized local account. Sources do not list affected Windows builds. Systems without ReFS volumes or without untrusted local users are likely lower priority.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["1123h2","1124h2","1125h2","1126h1","1126h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2"],"ptokens":["11","23h2","24h2","25h2","26h1","26h2","windows"],"labels":["fileserver","high","infrastructure","localprivilegeescalation","refs","windows","windows11","windowsserver"],"campaign_type":null,"search_a":"'-119386':16A,19A '-2026':15A,18A '11':21A,24A,27A,30A,33A '23h2':22A '24h2':25A '25h2':28A '26h1':31A '26h2':34A 'cve':14A,17A 'free':6A 'gain':11A 'higher':12A 'let':7A 'local':9A 'privileg':13A 'ref':2A 'use':4A 'use-after-fre':3A 'user':10A 'window':1A 'windows':20A,23A,26A,29A,32A","search_b":"'-11':46B '10':79B '11':111B '2022':114B '2025':116B '2026':81B '7.0':87B 'account':71B 'attack':88B 'build':106B,117B 'code':102B 'complex':89B 'confirm':120B 'cvss':86B 'escal':42B 'exploit':97B,101B 'file':36B,59B 'file-serv':35B 'fix':105B 'found':104B 'free':54B 'gain':72B 'high':90B 'higher':73B 'infrastructur':38B 'known':94B 'let':62B 'list':108B 'local':40B,64B 'local-privilege-escal':39B 'low':69B 'low-privileg':68B 'microsoft':75B 'nov':80B 'novemb':82B 'patch':83B 'privileg':41B,70B,74B 'public':100B 'publish':76B 'ref':43B,61B 'resili':58B 'server':37B,49B,113B 'system':60B 'tuesday':84B 'use':52B 'use-after-fre':51B 'user':65B 'window':44B,45B,48B,57B,110B 'windows-serv':47B","search_c":"'allow':130C 'attack':133C 'author':132C 'elev':135C 'file':127C 'free':123C 'local':137C 'privileg':136C 'ref':129C 'resili':126C 'system':128C 'use':121C 'window':125C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119386","severity":null,"published_at":"2026-11-10T19:19:52+00:00","modified_at":"2026-11-10T19:19:52+00:00","first_seen_at":"2026-11-10T19:24:56+00:00","fetched_at":"2026-11-10T19:24:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119386:3076","url":"https://nvd.nist.gov/vuln/detail/cve-2026-119386","severity":null,"published_at":"2026-11-10T22:58:54+00:00","modified_at":"2026-11-10T22:58:54+00:00","first_seen_at":"2026-11-10T22:58:54+00:00","fetched_at":"2026-11-10T22:58:54+00:00","note":"MSRC page is JS-only and returned empty, so nothing verified. Build ranges come from the CNA (Microsoft) data via OffSeq mirror; NVD still awaiting enrichment. Server 2022/2025 are listed as affected by cvefeed with no builds. No exploitation or PoC found. Revisit with the MSRC page or KB numbers for the Server builds.","cites":["https://nvd.nist.gov/vuln/detail/cve-2026-119386","https://radar.offseq.com/threat/cve-2026-119386-cwe-416-use-after-free-in-microsoft-windows-11-version-23h2-7a36a86b748e5b0a"]}],"documents":[{"id":119963,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-119386","title":"NVD CVE-2026-119386 (Microsoft CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":119964,"url":"https://radar.offseq.com/threat/cve-2026-119386-cwe-416-use-after-free-in-microsoft-windows-11-version-23h2-7a36a86b748e5b0a","title":"OffSeq Threat Radar CVE-2026-119386","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}