{"id":"CVE-2026-119847","kind":"vulnerability","aliases":["CVE-2026-119847"],"related":[],"title":"Windows Kerberos: heap buffer overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Kerberos component lets a user who already has an account on the machine raise their privileges. The sources give no further detail on the exact trigger.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["active-directory","infrastructure","kerberos","windows"],"not_affected_if":["no-local-logon"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:01+00:00","first_seen_at":"2026-11-10T19:24:59+00:00","triaged_at":"2026-11-10T19:40:23+00:00","updated_at":"2026-11-10T19:40:23+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:40:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Kerberos: heap buffer overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Kerberos component lets a user who already has an account on the machine raise their privileges. The sources give no further detail on the exact trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","kerberos","active-directory"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows machine","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-119847 to get affected Windows builds and the patch.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-logon"],"who_is_affected":"Windows machines that run the Kerberos component, which covers domain-joined Windows systems. Any user with an authorized local logon could use this flaw, so exposure depends on who can log on locally. The sources do not say which Windows versions are affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000667,"input_tokens":4492,"output_tokens":435,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-119847 to get affected Windows builds and the patch.","search":"'-119847':15A,18A '-2026':14A,17A 'account':43B 'activ':20B 'active-directori':19B 'allow':68C 'alreadi':40B 'attack':71C 'author':70C 'base':28B,62C 'buffer':4A,29B,63C 'compon':35B 'cve':13A,16A 'detail':55B 'directori':21B 'elev':73C 'exact':58B 'gain':10A 'give':52B 'heap':3A,27B,61C 'heap-bas':26B,60C 'higher':11A 'infrastructur':22B 'kerbero':2A,23B,34B,67C 'let':6A,36B 'local':8A,75C 'machin':46B 'overflow':5A,30B,64C 'privileg':12A,49B,74C 'rais':47B 'sourc':51B 'trigger':59B 'user':9A,38B 'window':1A,24B,33B,66C","nicknames":[],"mitigations":[],"who_affected":"Windows machines that run the Kerberos component, which covers domain-joined Windows systems. Any user with an authorized local logon could use this flaw, so exposure depends on who can log on locally. The sources do not say which Windows versions are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["activedirectory","high","infrastructure","kerberos","windows"],"campaign_type":null,"search_a":"'-119847':15A,18A '-2026':14A,17A 'buffer':4A 'cve':13A,16A 'gain':10A 'heap':3A 'higher':11A 'kerbero':2A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'user':9A 'window':1A","search_b":"'account':43B 'activ':20B 'active-directori':19B 'alreadi':40B 'base':28B 'buffer':29B 'compon':35B 'detail':55B 'directori':21B 'exact':58B 'give':52B 'heap':27B 'heap-bas':26B 'infrastructur':22B 'kerbero':23B,34B 'let':36B 'machin':46B 'overflow':30B 'privileg':49B 'rais':47B 'sourc':51B 'trigger':59B 'user':38B 'window':24B,33B","search_c":"'allow':68C 'attack':71C 'author':70C 'base':62C 'buffer':63C 'elev':73C 'heap':61C 'heap-bas':60C 'kerbero':67C 'local':75C 'overflow':64C 'privileg':74C 'window':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119847","severity":null,"published_at":"2026-11-10T19:20:01+00:00","modified_at":"2026-11-10T19:20:01+00:00","first_seen_at":"2026-11-10T19:24:59+00:00","fetched_at":"2026-11-10T19:24:59+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}