---
id: "CVE-2026-119837"
page: "https://infrastack.ai/live/CVE-2026-119837"
kind: "vulnerability"
aliases: ["CVE-2026-119837"]
title: "Windows UDF file system driver heap overflow lets a local user gain privileges"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": "< 10.0.19045.7846", "ecosystem": "microsoft"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": "< 10.0.26100.9974", "ecosystem": "microsoft"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": "< 10.0.26100.33822", "ecosystem": "microsoft"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": "< 10.0.20348.5870", "ecosystem": "microsoft"}]
ecosystems: []
tags: ["infrastructure", "local-privilege-escalation", "patch-tuesday", "udfs", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:19:59+00:00"
first_seen_at: "2026-11-10T19:24:58+00:00"
updated_at: "2026-11-10T22:49:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119837", "first_seen_at": "2026-11-10T19:24:58+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-119837", "first_seen_at": "2026-11-10T22:49:12+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-119837", "https://nvd.nist.gov/vuln/detail/cve-2026-119837"]}]
exploit_sources: []
---

# Windows UDF file system driver heap overflow lets a local user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-119837 (this .md is for agents)

Heap-based buffer overflow in the Windows UDF file system driver (UDFS) lets an authorized local attacker raise privileges. Microsoft's CNA record lists Windows 10, Windows 11 and Server 2016 to 2025 builds below the November 2026 updates. No exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- microsoft:Windows 10 22H2 affected < 10.0.19045.7846 fixed 10.0.19045.7846
- microsoft:Windows 11 24H2 affected < 10.0.26100.9974 fixed 10.0.26100.9974
- microsoft:Windows Server 2025 affected < 10.0.26100.33822 fixed 10.0.26100.33822
- microsoft:Windows Server 2022 affected < 10.0.20348.5870 fixed 10.0.20348.5870

## How to check

Run winver or [System.Environment]::OSVersion in PowerShell and compare the build number (major.revision, e.g. 10.0.19045.xxxx) to the fixed builds in the fix field. Anything lower is affected. Confirm against the Microsoft Security Update Guide entry for CVE-2026-119837.

## Fix

Install the November 2026 Windows cumulative update. Fixed builds: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822.

## Timeline

- 2026-11-10T19:24:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119837
- 2026-11-10T22:49:12+00:00 analyst https://app.opencve.io/cve/CVE-2026-119837 — Could not load the MSRC page (empty); builds come from Microsoft's CNA record as mirrored by OpenCVE/NVD, so nothing marked verified. CNA record is inconsistent: description says heap overflow, local; CWE-416 and vector AV:N/UI:R. Not exploited or in KEV as of Nov 10.

## Documents

- [describes] OpenCVE: CVE-2026-119837 (mirror of Microsoft CNA record) https://app.opencve.io/cve/CVE-2026-119837
- [describes] NVD: CVE-2026-119837 https://nvd.nist.gov/vuln/detail/cve-2026-119837

## From the sources

Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_