{"id":"CVE-2026-119831","kind":"vulnerability","aliases":["CVE-2026-119831"],"related":[],"title":"Windows Installer: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in Windows Installer lets an authorized local user raise their privileges. An attacker who already has a foothold on the machine can gain elevated rights.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Installer","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","windows","windows-installer"],"not_affected_if":["no-local-accounts","single-user-machine"],"how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update for CVE-2026-119831 (unknown if the sources list affected builds)\n- Review Windows Update history for the installer component (unknown if the sources name a patch)","fix":null,"status":"open","published_at":"2026-11-10T19:19:58+00:00","first_seen_at":"2026-11-10T19:24:58+00:00","triaged_at":"2026-11-10T19:51:50+00:00","updated_at":"2026-11-10T19:51:50+00:00","category":"infrastructure","confidence":0.55,"triage":{"at":"2026-11-10T19:51:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Installer: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in Windows Installer lets an authorized local user raise their privileges. An attacker who already has a foothold on the machine can gain elevated rights.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-installer"],"confidence":0.55,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Confirm affected Windows builds and the Microsoft patch from the NVD entry or the Microsoft Security Update Guide for CVE-2026-119831.","how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update for CVE-2026-119831 (unknown if the sources list affected builds)\n- Review Windows Update history for the installer component (unknown if the sources name a patch)","plain_action":"","product_name":"Windows Installer","needs_analyst":true,"not_affected_if":["no-local-accounts","single-user-machine"],"who_is_affected":"Windows machines where users can log in locally, since the attacker must already be authorized on the system. Shared workstations, terminal servers and build hosts are the likeliest to matter. unknown whether specific Windows versions are affected.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4488,"output_tokens":538,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Windows builds and the Microsoft patch from the NVD entry or the Microsoft Security Update Guide for CVE-2026-119831.","search":"'-119831':14A,17A '-2026':13A,16A 'allow':64C 'alreadi':45B 'attack':43B,67C 'author':36B,66C 'base':28B,58C 'buffer':29B,59C 'cve':12A,15A 'elev':54B,69C 'foothold':48B 'gain':9A,53B 'heap':3A,27B,57C 'heap-bas':26B,56C 'higher':10A 'infrastructur':20B 'instal':2A,24B,33B,63C 'installer':19A 'let':5A,34B 'local':7A,37B,71C 'machin':51B 'overflow':4A,30B,60C 'privileg':11A,41B,70C 'rais':39B 'right':55B 'user':8A,38B 'window':1A,21B,23B,32B,62C 'windows':18A 'windows-instal':22B","nicknames":[],"mitigations":[],"who_affected":"Windows machines where users can log in locally, since the attacker must already be authorized on the system. Shared workstations, terminal servers and build hosts are the likeliest to matter. unknown whether specific Windows versions are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["installer","windowsinstaller"],"ptokens":["installer","windows"],"labels":["high","infrastructure","vendor","windows","windowsinstaller"],"campaign_type":null,"search_a":"'-119831':14A,17A '-2026':13A,16A 'cve':12A,15A 'gain':9A 'heap':3A 'higher':10A 'instal':2A 'installer':19A 'let':5A 'local':7A 'overflow':4A 'privileg':11A 'user':8A 'window':1A 'windows':18A","search_b":"'alreadi':45B 'attack':43B 'author':36B 'base':28B 'buffer':29B 'elev':54B 'foothold':48B 'gain':53B 'heap':27B 'heap-bas':26B 'infrastructur':20B 'instal':24B,33B 'let':34B 'local':37B 'machin':51B 'overflow':30B 'privileg':41B 'rais':39B 'right':55B 'user':38B 'window':21B,23B,32B 'windows-instal':22B","search_c":"'allow':64C 'attack':67C 'author':66C 'base':58C 'buffer':59C 'elev':69C 'heap':57C 'heap-bas':56C 'instal':63C 'local':71C 'overflow':60C 'privileg':70C 'window':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119831","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119831","severity":null,"published_at":"2026-11-10T19:19:58+00:00","modified_at":"2026-11-10T19:19:58+00:00","first_seen_at":"2026-11-10T19:24:58+00:00","fetched_at":"2026-11-10T19:24:58+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}