{"id":"CVE-2026-119817","kind":"vulnerability","aliases":["CVE-2026-119817"],"related":[],"title":"Windows Shell: double free lets a local user gain elevated privileges","description":"Double free in Windows Shell allows an authorized attacker to elevate privileges locally.","summary":"A double free bug in the Windows Shell lets an attacker who already has a local account raise their privileges. The sources give no further detail on the exploit path.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","self-hosted","windows"],"not_affected_if":["no-local-users"],"how_to_check":"- Run `winver` on the machine and compare the build against Microsoft's security update guide for this CVE\n- Check Windows Update history for the latest cumulative update installed","fix":null,"status":"open","published_at":"2026-11-10T19:19:56+00:00","first_seen_at":"2026-11-10T19:24:57+00:00","triaged_at":"2026-11-10T19:40:30+00:00","updated_at":"2026-11-10T19:40:30+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:40:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Shell: double free lets a local user gain elevated privileges","impact":"high","summary":"A double free bug in the Windows Shell lets an attacker who already has a local account raise their privileges. The sources give no further detail on the exploit path.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Confirm affected Windows builds and fixed cumulative update from the Microsoft Security Update Guide entry for CVE-2026-119817; sources give no fix or product ranges.","how_to_check":"- Run `winver` on the machine and compare the build against Microsoft's security update guide for this CVE\n- Check Windows Update history for the latest cumulative update installed","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Windows machines where a user already has a local login can use this flaw to gain more privileges. The sources do not name affected Windows builds or the exact code path, so check the vendor advisory for the versions in scope. Machines where only trusted administrators log in carry less practical risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":4472,"output_tokens":491,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Windows builds and fixed cumulative update from the Microsoft Security Update Guide entry for CVE-2026-119817; sources give no fix or product ranges.","search":"'-119817':14A,17A '-2026':13A,16A 'account':39B 'allow':58C 'alreadi':35B 'attack':33B,61C 'author':60C 'bug':26B 'cve':12A,15A 'detail':48B 'doubl':3A,24B,53C 'elev':10A,63C 'exploit':51B 'free':4A,25B,54C 'gain':9A 'give':45B 'host':21B 'infrastructur':18B 'let':5A,31B 'local':7A,38B,65C 'path':52B 'privileg':11A,42B,64C 'rais':40B 'self':20B 'self-host':19B 'shell':2A,30B,57C 'sourc':44B 'user':8A 'window':1A,22B,29B,56C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where a user already has a local login can use this flaw to gain more privileges. The sources do not name affected Windows builds or the exact code path, so check the vendor advisory for the versions in scope. Machines where only trusted administrators log in carry less practical risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","selfhosted","windows"],"campaign_type":null,"search_a":"'-119817':14A,17A '-2026':13A,16A 'cve':12A,15A 'doubl':3A 'elev':10A 'free':4A 'gain':9A 'let':5A 'local':7A 'privileg':11A 'shell':2A 'user':8A 'window':1A","search_b":"'account':39B 'alreadi':35B 'attack':33B 'bug':26B 'detail':48B 'doubl':24B 'exploit':51B 'free':25B 'give':45B 'host':21B 'infrastructur':18B 'let':31B 'local':38B 'path':52B 'privileg':42B 'rais':40B 'self':20B 'self-host':19B 'shell':30B 'sourc':44B 'window':22B,29B","search_c":"'allow':58C 'attack':61C 'author':60C 'doubl':53C 'elev':63C 'free':54C 'local':65C 'privileg':64C 'shell':57C 'window':56C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119817","severity":null,"published_at":"2026-11-10T19:19:56+00:00","modified_at":"2026-11-10T19:19:56+00:00","first_seen_at":"2026-11-10T19:24:57+00:00","fetched_at":"2026-11-10T19:24:57+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}