---
id: "CVE-2026-119822"
page: "https://infrastack.ai/live/CVE-2026-119822"
kind: "vulnerability"
aliases: ["CVE-2026-119822"]
title: "Windows Overlay Filter flaw lets a local user gain elevated privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "windows-10", "fixed": ["10.0.14393.9688", "10.0.17763.9487", "10.0.19044.7846", "10.0.19045.7846"], "affected": "1607 < 10.0.14393.9688; 1809 < 10.0.17763.9487; 21H2 < 10.0.19044.7846; 22H2 < 10.0.19045.7846", "ecosystem": "vendor"}, {"name": "windows-11", "fixed": ["10.0.22631.7711", "10.0.26100.9974", "10.0.26200.9974", "10.0.28000.3501", "10.0.26300.9974"], "affected": "23H2 < 10.0.22631.7711; 24H2 < 10.0.26100.9974; 25H2 < 10.0.26200.9974; 26H1 < 10.0.28000.3501; 26H2 < 10.0.26300.9974", "ecosystem": "vendor"}, {"name": "windows-server", "fixed": ["10.0.14393.9688"], "affected": "2016 < 10.0.14393.9688 (CVE record); 2019, 2022, 2025 listed fixed in Nov 2026 updates", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "local-privilege-escalation", "windows", "windows-10", "windows-11", "windows-server"]
not_affected_if: ["patched-nov-2026"]
published_at: "2026-11-10T19:19:56+00:00"
first_seen_at: "2026-11-10T19:24:57+00:00"
updated_at: "2026-11-10T22:51:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119822", "first_seen_at": "2026-11-10T19:24:57+00:00"}, {"source": "analyst", "url": "https://cvefocus.com/cve/CVE-2026-119822", "first_seen_at": "2026-11-10T22:51:18+00:00", "cites": ["https://cvefocus.com/cve/CVE-2026-119822", "https://nvd.nist.gov/vuln/detail/CVE-2026-119822"]}]
exploit_sources: []
---

# Windows Overlay Filter flaw lets a local user gain elevated privileges

Link for people: https://infrastack.ai/live/CVE-2026-119822 (this .md is for agents)

Windows Overlay Filter exposes sensitive system information to an unauthorized control sphere. An authorized local attacker can use this to elevate their privileges on the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:windows-10 affected 1607 < 10.0.14393.9688; 1809 < 10.0.17763.9487; 21H2 < 10.0.19044.7846; 22H2 < 10.0.19045.7846 fixed 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846
- vendor:windows-11 affected 23H2 < 10.0.22631.7711; 24H2 < 10.0.26100.9974; 25H2 < 10.0.26200.9974; 26H1 < 10.0.28000.3501; 26H2 < 10.0.26300.9974 fixed 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974
- vendor:windows-server affected 2016 < 10.0.14393.9688 (CVE record); 2019, 2022, 2025 listed fixed in Nov 2026 updates fixed 10.0.14393.9688

## How to check

Run winver or [System.Environment]::OSVersion and compare the build (10.0.<build>.<revision>) to the fixed builds. Exposed if below the fixed revision for your release, e.g. Windows 11 24H2 below 10.0.26100.9974, Windows 10 22H2 below 10.0.19045.7846, Server 2022 below 10.0.20348.5870. Check the build against the MSRC page for CVE-2026-119822.

## Fix

Install the November 2026 Windows cumulative update. Examples: Win10 22H2 KB5131096 (10.0.19045.7846); Win11 23H2 KB5131087 (10.0.22631.7711); Win11 24H2/25H2 KB5132043 (CVE record says 10.0.26100.9974 / 10.0.26200.9974); Server 2025 KB5131077; Server 2022 KB5131090; Server 2019 KB5131085; Server 2016 KB5131291.

## Timeline

- 2026-11-10T19:24:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119822
- 2026-11-10T22:51:18+00:00 analyst https://cvefocus.com/cve/CVE-2026-119822 — MSRC page is JS-only and unreadable here; fixed builds taken from CVEfocus, which relays the CVE record and MSRC Nov 2026 KB data. Not verified. Its KB table and CVE-record ranges disagree on Win11 24H2/25H2/26H2 (9911 vs 9974); confirm on MSRC. No exploitation or PoC seen.

## Documents

- [describes] CVEfocus: CVE-2026-119822 (relays CVE record and MSRC KB data) https://cvefocus.com/cve/CVE-2026-119822
- [mentions] NVD CVE-2026-119822 https://nvd.nist.gov/vuln/detail/CVE-2026-119822

## From the sources

Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_