{"id":"CVE-2026-119391","kind":"vulnerability","aliases":["CVE-2026-119391"],"related":[],"title":"Windows Hyper-V: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in Windows Hyper-V lets an attacker who already has a local account raise their privileges. The sources give a CVSS score of 7.8 and say nothing else about the exploit path.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Hyper-V","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["hyper-v","infrastructure","local","privilege-escalation","windows","windows-server"],"not_affected_if":["hyper-v-role-not-installed"],"how_to_check":"Run winver or [Environment]::OSVersion in PowerShell and compare the full build number with the fixed builds in the fix field. Hosts below the fixed build are affected. Also check Hyper-V is enabled: Get-WindowsFeature Hyper-V (Server) or Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V (client). Microsoft's CNA data lists the builds but not whether the role must be enabled; confirm on the MSRC page.","fix":"Install the November 2026 Windows cumulative update: Win11 23H2 10.0.22631.7711, 24H2 10.0.26100.9974, 25H2 10.0.26200.9974, 26H1 10.0.28000.3501, 26H2 10.0.26300.9974, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822.","status":"open","published_at":"2026-11-10T19:19:53+00:00","first_seen_at":"2026-11-10T19:24:56+00:00","triaged_at":"2026-11-10T19:40:33+00:00","updated_at":"2026-11-10T22:54:27+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:40:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Hyper-V: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in Windows Hyper-V lets an attacker who already has a local account raise their privileges. The sources give a CVSS score of 7.8 and say nothing else about the exploit path.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","hyper-v"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the host","analyst_note":"Confirm affected Windows builds and the fixed update from Microsoft's security update guide for CVE-2026-119391.","how_to_check":"- Check whether the Hyper-V role is installed on Windows hosts, for example with `Get-WindowsFeature Hyper-V` in PowerShell\n- Compare the installed Windows build against Microsoft's security update guide entry for CVE-2026-119391 (unknown from these sources)","plain_action":"","product_name":"Windows Hyper-V","needs_analyst":true,"not_affected_if":["hyper-v-role-not-installed"],"who_is_affected":"Hyper-V hosts on Windows are the systems in scope, since the flaw sits in Hyper-V itself. The sources do not say which Windows builds or Hyper-V configurations are affected, so whether machines without the Hyper-V role are exposed is unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4480,"output_tokens":569,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Windows builds and the fixed update from Microsoft's security update guide for CVE-2026-119391.","search":"'-119391':18A,21A '-2026':17A,20A '11':27A,30A,33A,36A,39A '2022':43A '2025':46A '23h2':28A '24h2':31A '25h2':34A '26h1':37A '26h2':40A '7.8':89B 'account':78B 'allow':106C 'alreadi':74B 'attack':72B,109C 'author':108C 'bug':64B 'cve':16A,19A 'cvss':86B 'elev':111C 'els':93B 'escal':54B 'exploit':96B 'free':8A,63B,100C 'gain':13A 'give':84B 'higher':14A 'hyper':3A,24A,48B,68B,104C 'hyper-v':2A,23A,47B,67B,103C 'infrastructur':50B 'let':9A,70B 'local':11A,51B,77B,113C 'noth':92B 'path':97B 'privileg':15A,53B,81B,112C 'privilege-escal':52B 'rais':79B 'say':91B 'score':87B 'server':42A,45A,58B 'sourc':83B 'use':6A,61B,98C 'use-after-fre':5A,60B 'user':12A 'v':4A,25A,49B,69B,105C 'window':1A,55B,57B,66B,102C 'windows':22A,26A,29A,32A,35A,38A,41A,44A 'windows-serv':56B","nicknames":[],"mitigations":[],"who_affected":"Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2022 and Server 2025 (including Server Core) builds below the fixed versions, per Microsoft's CNA data. A local user with a low-privilege account can raise privileges (CVSS 7.8, local, no user interaction). Workstations and servers running Hyper-V and multi-user hosts matter most. Microsoft's data does not say whether hosts without the Hyper-V role are exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1123h2","1124h2","1125h2","1126h1","1126h2","hyperv","server2022","server2025","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowshyperv","windowsserver2022","windowsserver2025"],"ptokens":["11","2022","2025","23h2","24h2","25h2","26h1","26h2","hyper","server","windows"],"labels":["high","hyperv","infrastructure","local","privilegeescalation","vendor","windows","windowsserver"],"campaign_type":null,"search_a":"'-119391':18A,21A '-2026':17A,20A '11':27A,30A,33A,36A,39A '2022':43A '2025':46A '23h2':28A '24h2':31A '25h2':34A '26h1':37A '26h2':40A 'cve':16A,19A 'free':8A 'gain':13A 'higher':14A 'hyper':3A,24A 'hyper-v':2A,23A 'let':9A 'local':11A 'privileg':15A 'server':42A,45A 'use':6A 'use-after-fre':5A 'user':12A 'v':4A,25A 'window':1A 'windows':22A,26A,29A,32A,35A,38A,41A,44A","search_b":"'7.8':89B 'account':78B 'alreadi':74B 'attack':72B 'bug':64B 'cvss':86B 'els':93B 'escal':54B 'exploit':96B 'free':63B 'give':84B 'hyper':48B,68B 'hyper-v':47B,67B 'infrastructur':50B 'let':70B 'local':51B,77B 'noth':92B 'path':97B 'privileg':53B,81B 'privilege-escal':52B 'rais':79B 'say':91B 'score':87B 'server':58B 'sourc':83B 'use':61B 'use-after-fre':60B 'v':49B,69B 'window':55B,57B,66B 'windows-serv':56B","search_c":"'allow':106C 'attack':109C 'author':108C 'elev':111C 'free':100C 'hyper':104C 'hyper-v':103C 'local':113C 'privileg':112C 'use':98C 'v':105C 'window':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119391","severity":null,"published_at":"2026-11-10T19:19:53+00:00","modified_at":"2026-11-10T19:19:53+00:00","first_seen_at":"2026-11-10T19:24:56+00:00","fetched_at":"2026-11-10T19:24:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119391:3071","url":"https://nvd.nist.gov/vuln/detail/cve-2026-119391","severity":null,"published_at":"2026-11-10T22:54:27+00:00","modified_at":"2026-11-10T22:54:27+00:00","first_seen_at":"2026-11-10T22:54:27+00:00","fetched_at":"2026-11-10T22:54:27+00:00","note":"Microsoft CNA affected/fixed builds read via NVD (MSRC page not retrievable); not marked verified. Not in ZDI's exploited list (only Outlook CVE-2026-124194 is exploited). No PoC found.","cites":["https://nvd.nist.gov/vuln/detail/cve-2026-119391"]}],"documents":[{"id":119798,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-119391","title":"NVD CVE-2026-119391 (Microsoft CNA affected list)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}