{"id":"CVE-2026-119861","kind":"vulnerability","aliases":["CVE-2026-119861"],"related":[],"title":"Windows ICS: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.","summary":"Windows Internet Connection Sharing has a heap-based buffer overflow. An authorized local attacker can use it to elevate their privileges on the machine.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","internet-connection-sharing","windows"],"not_affected_if":["ics-not-enabled"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:04+00:00","first_seen_at":"2026-11-10T19:25:00+00:00","triaged_at":"2026-11-10T19:51:41+00:00","updated_at":"2026-11-10T19:51:41+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:51:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows ICS: heap overflow lets a local user gain higher privileges","impact":"high","summary":"Windows Internet Connection Sharing has a heap-based buffer overflow. An authorized local attacker can use it to elevate their privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","internet-connection-sharing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local account gains elevated system privileges on the machine","analyst_note":"Check Microsoft's MSRC advisory for CVE-2026-119861 for affected Windows builds, whether ICS must be enabled, and the fixed update.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["ics-not-enabled"],"who_is_affected":"Windows machines with Internet Connection Sharing in use are the systems to look at, since the flaw is in the ICS component. The sources do not say which Windows versions or whether ICS must be enabled. Attackers need a local authorized account, so internet-only exposure is not described.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000672,"input_tokens":4508,"output_tokens":442,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check Microsoft's MSRC advisory for CVE-2026-119861 for affected Windows builds, whether ICS must be enabled, and the fixed update.","search":"'-119861':14A,17A '-2026':13A,16A 'allow':60C 'attack':38B,63C 'author':36B,62C 'base':32B,51C 'buffer':33B,52C 'connect':21B,26B,57C 'cve':12A,15A 'elev':43B,65C 'gain':9A 'heap':3A,31B,50C 'heap-bas':30B,49C 'higher':10A 'ic':2A,59C 'infrastructur':18B 'internet':20B,25B,56C 'internet-connection-shar':19B 'let':5A 'local':7A,37B,67C 'machin':48B 'overflow':4A,34B,53C 'privileg':11A,45B,66C 'share':22B,27B,58C 'use':40B 'user':8A 'window':1A,23B,24B,55C","nicknames":[],"mitigations":[],"who_affected":"Windows machines with Internet Connection Sharing in use are the systems to look at, since the flaw is in the ICS component. The sources do not say which Windows versions or whether ICS must be enabled. Attackers need a local authorized account, so internet-only exposure is not described.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","internetconnectionsharing","windows"],"campaign_type":null,"search_a":"'-119861':14A,17A '-2026':13A,16A 'cve':12A,15A 'gain':9A 'heap':3A 'higher':10A 'ic':2A 'let':5A 'local':7A 'overflow':4A 'privileg':11A 'user':8A 'window':1A","search_b":"'attack':38B 'author':36B 'base':32B 'buffer':33B 'connect':21B,26B 'elev':43B 'heap':31B 'heap-bas':30B 'infrastructur':18B 'internet':20B,25B 'internet-connection-shar':19B 'local':37B 'machin':48B 'overflow':34B 'privileg':45B 'share':22B,27B 'use':40B 'window':23B,24B","search_c":"'allow':60C 'attack':63C 'author':62C 'base':51C 'buffer':52C 'connect':57C 'elev':65C 'heap':50C 'heap-bas':49C 'ic':59C 'internet':56C 'local':67C 'overflow':53C 'privileg':66C 'share':58C 'window':55C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119861","severity":null,"published_at":"2026-11-10T19:20:04+00:00","modified_at":"2026-11-10T19:20:04+00:00","first_seen_at":"2026-11-10T19:25:00+00:00","fetched_at":"2026-11-10T19:25:00+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}