---
id: "CVE-2026-119856"
page: "https://infrastack.ai/live/CVE-2026-119856"
kind: "vulnerability"
aliases: ["CVE-2026-119856"]
title: "Windows Win32K: local user can read sensitive system information"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "win32k", "windows"]
not_affected_if: ["no-local-untrusted-users"]
published_at: "2026-11-10T19:20:03+00:00"
first_seen_at: "2026-11-10T19:24:59+00:00"
updated_at: "2026-11-10T20:00:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119856", "first_seen_at": "2026-11-10T19:24:59+00:00"}]
exploit_sources: []
---

# Windows Win32K: local user can read sensitive system information

Link for people: https://infrastack.ai/live/CVE-2026-119856 (this .md is for agents)

Microsoft's Windows Win32K kernel graphics component exposes sensitive system information to an unauthorized control sphere. An authorized local attacker can read that information on the affected machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T19:24:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119856

## From the sources

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_