---
id: "CVE-2026-119386"
page: "https://infrastack.ai/live/CVE-2026-119386"
kind: "vulnerability"
aliases: ["CVE-2026-119386"]
title: "Windows ReFS: use-after-free lets a local user gain higher privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": ">= 10.0.22631.0, < 10.0.22631.7711", "ecosystem": "microsoft"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": ">= 10.0.26100.0, < 10.0.26100.9974", "ecosystem": "microsoft"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9974"], "affected": ">= 10.0.26200.0, < 10.0.26200.9974", "ecosystem": "microsoft"}, {"name": "Windows 11 26H1", "fixed": ["10.0.28000.3501"], "affected": ">= 10.0.28000.0, < 10.0.28000.3501", "ecosystem": "microsoft"}, {"name": "Windows 11 26H2", "fixed": ["10.0.26300.9974"], "affected": ">= 10.0.26300.0, < 10.0.26300.9974", "ecosystem": "microsoft"}]
ecosystems: []
tags: ["file-server", "infrastructure", "local-privilege-escalation", "refs", "windows", "windows-11", "windows-server"]
not_affected_if: ["no-refs-volumes", "no-untrusted-local-users", "patched"]
published_at: "2026-11-10T19:19:52+00:00"
first_seen_at: "2026-11-10T19:24:56+00:00"
updated_at: "2026-11-10T22:58:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119386", "first_seen_at": "2026-11-10T19:24:56+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/cve-2026-119386", "first_seen_at": "2026-11-10T22:58:54+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/cve-2026-119386", "https://radar.offseq.com/threat/cve-2026-119386-cwe-416-use-after-free-in-microsoft-windows-11-version-23h2-7a36a86b748e5b0a"]}]
exploit_sources: []
---

# Windows ReFS: use-after-free lets a local user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-119386 (this .md is for agents)

A use-after-free in the Windows Resilient File System (ReFS) lets a local user with a low-privilege account gain higher privileges. Microsoft published it on 10 Nov 2026 (November Patch Tuesday) with CVSS 7.0 (attack complexity high). It is not known to be exploited and no public exploit code was found. Fixed builds are listed for Windows 11; the Server 2022 and 2025 builds are not confirmed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- microsoft:Windows 11 23H2 affected >= 10.0.22631.0, < 10.0.22631.7711 fixed 10.0.22631.7711
- microsoft:Windows 11 24H2 affected >= 10.0.26100.0, < 10.0.26100.9974 fixed 10.0.26100.9974
- microsoft:Windows 11 25H2 affected >= 10.0.26200.0, < 10.0.26200.9974 fixed 10.0.26200.9974
- microsoft:Windows 11 26H1 affected >= 10.0.28000.0, < 10.0.28000.3501 fixed 10.0.28000.3501
- microsoft:Windows 11 26H2 affected >= 10.0.26300.0, < 10.0.26300.9974 fixed 10.0.26300.9974

## How to check

Run winver or [System.Environment]::OSVersion in PowerShell and compare the build with the fixed builds. Then run Get-Volume | Where FileSystem -eq ReFS to see if any ReFS volume exists. Whether ReFS must be in use for the bug to be reachable is not stated in the sources I read.

## Fix

Install the 10 Nov 2026 cumulative update. Fixed Windows 11 builds: 23H2 10.0.22631.7711, 24H2 10.0.26100.9974, 25H2 10.0.26200.9974, 26H1 10.0.28000.3501, 26H2 10.0.26300.9974. Server 2022 and 2025 fixed builds: unknown, not read.

## Timeline

- 2026-11-10T19:24:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119386
- 2026-11-10T22:58:54+00:00 analyst https://nvd.nist.gov/vuln/detail/cve-2026-119386 — MSRC page is JS-only and returned empty, so nothing verified. Build ranges come from the CNA (Microsoft) data via OffSeq mirror; NVD still awaiting enrichment. Server 2022/2025 are listed as affected by cvefeed with no builds. No exploitation or PoC found. Revisit with the MSRC page or KB numbers for the Server builds.

## Documents

- [describes] NVD CVE-2026-119386 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/cve-2026-119386
- [describes] OffSeq Threat Radar CVE-2026-119386 https://radar.offseq.com/threat/cve-2026-119386-cwe-416-use-after-free-in-microsoft-windows-11-version-23h2-7a36a86b748e5b0a

## From the sources

Use after free in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_