---
id: "CVE-2026-119388"
page: "https://infrastack.ai/live/CVE-2026-119388"
kind: "vulnerability"
aliases: ["CVE-2026-119388"]
title: "Windows QWAVE service use-after-free lets a local user gain higher privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["endpoints", "infrastructure", "local", "privilege-escalation", "windows", "windows-server"]
not_affected_if: ["non-windows-systems"]
published_at: "2026-11-10T19:19:52+00:00"
first_seen_at: "2026-11-10T19:24:56+00:00"
updated_at: "2026-11-10T22:56:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119388", "first_seen_at": "2026-11-10T19:24:56+00:00"}, {"source": "analyst", "url": "https://cvefeed.io/vuln/detail/CVE-2026-119388", "first_seen_at": "2026-11-10T22:56:34+00:00", "cites": ["https://cvefeed.io/vuln/detail/CVE-2026-119388"]}]
exploit_sources: []
---

# Windows QWAVE service use-after-free lets a local user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-119388 (this .md is for agents)

Microsoft's November 2026 Patch Tuesday fixes a use-after-free in the Windows QWAVE (Quality Windows Audio/Video Experience) service. A local attacker who is already logged in could use it to gain higher privileges. CVSS 3.1 score is 7.0 (High), not remotely exploitable. Aggregator data lists Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2 arm64) and Windows Server 2016, 2019, 2022 and 2025. No exploitation or public PoC is reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run winver (or Get-ComputerInfo) and compare the build with the fixed build for your Windows version in Microsoft's Security Update Guide entry for CVE-2026-119388 (not read yet: the page needs JavaScript). Alternatively, check that the November 2026 cumulative update is installed with: Get-HotFix. 'sc query QWAVE' shows whether the service is running, but a stopped service is not confirmed as safe.

## Timeline

- 2026-11-10T19:24:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119388
- 2026-11-10T22:56:34+00:00 analyst https://cvefeed.io/vuln/detail/CVE-2026-119388 — Could not read MSRC entry (JS-only page, empty via web-cli, browser quota exhausted, CVRF API empty). Only cvefeed mirror of the Microsoft CNA data: CVSS 7.0, 15 Windows products, no KB/build numbers, so fix left unknown and nothing verified. Next run: get KB/builds from MSRC; check whether QWAVE is on by default. Possibly related: a forum user ties KB5101650 (July) to a QWAVE patch, unverified.

## Documents

- [describes] CVE-2026-119388 on cvefeed (mirrors Microsoft CNA data) https://cvefeed.io/vuln/detail/CVE-2026-119388

## From the sources

Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_