{"id":"CVE-2026-119865","kind":"vulnerability","aliases":["CVE-2026-119865"],"related":[],"title":"Windows Installer: race condition lets a local user gain higher privileges","description":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Windows Installer has a race condition, where two operations use a shared resource without proper synchronization. A local user with some access can exploit it to elevate their privileges on the machine.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Installer","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 10 1607","fixed":["10.0.14393.9612"],"affected":">=10.0.14393.0, <10.0.14393.9612","ecosystem":"vendor"},{"name":"Windows 10 1809","fixed":["10.0.17763.9376"],"affected":">=10.0.17763.0, <10.0.17763.9376","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7807"],"affected":">=10.0.19044.0, <10.0.19044.7807","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7807"],"affected":">=10.0.19045.0, <10.0.19045.7807","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7652"],"affected":">=10.0.22631.0, <10.0.22631.7652","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local-privilege-escalation","race-condition","windows","windows-installer"],"not_affected_if":[],"how_to_check":"Run winver or 'cmd /c ver' and compare the build (10.0.<build>.<revision>) with the fixed revisions listed in the fix field; a revision below the fixed one is vulnerable.","fix":"Install the November 2026 Windows cumulative update for your build: Win10 1607 10.0.14393.9612, 1809 10.0.17763.9376, 21H2 10.0.19044.7807, 22H2 10.0.19045.7807, Win11 23H2 10.0.22631.7652. Builds for Server, Win11 24H2/25H2/26H1/26H2 not read: see MSRC entry.","status":"open","published_at":"2026-11-10T19:20:05+00:00","first_seen_at":"2026-11-10T19:25:00+00:00","triaged_at":"2026-11-10T19:51:41+00:00","updated_at":"2026-11-10T22:45:42+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:51:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Installer: race condition lets a local user gain higher privileges","impact":"high","summary":"Windows Installer has a race condition, where two operations use a shared resource without proper synchronization. A local user with some access can exploit it to elevate their privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-installer"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119865 for affected Windows builds, the fixed update, and whether exploitation is known.","how_to_check":"unknown","plain_action":"","product_name":"Windows Installer","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000637,"input_tokens":4499,"output_tokens":374,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119865 for affected Windows builds, the fixed update, and whether exploitation is known.","search":"'-119865':14A,17A '-2026':13A,16A '10':21A,24A,27A,30A '11':33A '1607':22A '1809':25A '21h2':28A '22h2':31A '23h2':34A 'access':68B 'allow':92C 'attack':95C 'author':94C 'concurr':79C 'condit':4A,42B,52B,88C 'cve':12A,15A 'elev':73B,97C 'escal':39B 'execut':80C 'exploit':70B 'gain':9A 'higher':10A 'improp':85C 'infrastructur':35B 'instal':2A,46B,48B,91C 'installer':19A 'let':5A 'local':7A,37B,64B,99C 'local-privilege-escal':36B 'machin':78B 'oper':55B 'privileg':11A,38B,75B,98C 'proper':61B 'race':3A,41B,51B,87C 'race-condit':40B 'resourc':59B,83C 'share':58B,82C 'synchron':62B,86C 'two':54B 'use':56B,81C 'user':8A,65B 'window':1A,43B,45B,47B,90C 'windows':18A,20A,23A,26A,29A,32A 'windows-instal':44B 'without':60B","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine where a low-privileged user can run code locally: shared workstations, terminal/RDP servers, build agents, VDI. Exploitation needs local access and is rated high complexity (race condition), so single-user machines with no untrusted local code are lower priority. Microsoft lists Windows 10, 11 and Server 2012 to 2025.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["101607","101809","1021h2","1022h2","1123h2","installer","windows101607","windows101809","windows1021h2","windows1022h2","windows1123h2","windowsinstaller"],"ptokens":["10","11","1607","1809","21h2","22h2","23h2","installer","windows"],"labels":["high","infrastructure","localprivilegeescalation","racecondition","vendor","windows","windowsinstaller"],"campaign_type":null,"search_a":"'-119865':14A,17A '-2026':13A,16A '10':21A,24A,27A,30A '11':33A '1607':22A '1809':25A '21h2':28A '22h2':31A '23h2':34A 'condit':4A 'cve':12A,15A 'gain':9A 'higher':10A 'instal':2A 'installer':19A 'let':5A 'local':7A 'privileg':11A 'race':3A 'user':8A 'window':1A 'windows':18A,20A,23A,26A,29A,32A","search_b":"'access':68B 'condit':42B,52B 'elev':73B 'escal':39B 'exploit':70B 'infrastructur':35B 'instal':46B,48B 'local':37B,64B 'local-privilege-escal':36B 'machin':78B 'oper':55B 'privileg':38B,75B 'proper':61B 'race':41B,51B 'race-condit':40B 'resourc':59B 'share':58B 'synchron':62B 'two':54B 'use':56B 'user':65B 'window':43B,45B,47B 'windows-instal':44B 'without':60B","search_c":"'allow':92C 'attack':95C 'author':94C 'concurr':79C 'condit':88C 'elev':97C 'execut':80C 'improp':85C 'instal':91C 'local':99C 'privileg':98C 'race':87C 'resourc':83C 'share':82C 'synchron':86C 'use':81C 'window':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119865","severity":null,"published_at":"2026-11-10T19:20:05+00:00","modified_at":"2026-11-10T19:20:05+00:00","first_seen_at":"2026-11-10T19:25:00+00:00","fetched_at":"2026-11-10T19:25:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119865:3036","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119865","severity":null,"published_at":"2026-11-10T22:45:42+00:00","modified_at":"2026-11-10T22:45:42+00:00","first_seen_at":"2026-11-10T22:45:42+00:00","fetched_at":"2026-11-10T22:45:42+00:00","note":"MSRC page is JS-only (unreadable); build numbers taken from Microsoft CNA record as mirrored by OffSeq (only 6 of ~13 builds shown). Not exploited per OffSeq/no KEV; no PoC found. Nothing verified.","cites":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119865","https://radar.offseq.com/threat/cve-2026-119865-cwe-362-race-condition-in-microsoft-windows-10-version-1607-ffcb50fa83035820"]}],"documents":[{"id":119725,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119865","title":"MSRC Security Update Guide: CVE-2026-119865 (page content not rendered)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":119726,"url":"https://radar.offseq.com/threat/cve-2026-119865-cwe-362-race-condition-in-microsoft-windows-10-version-1607-ffcb50fa83035820","title":"OffSeq Threat Radar: CVE-2026-119865 (mirrors Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}