{"id":"CVE-2026-119870","kind":"vulnerability","aliases":["CVE-2026-119870"],"related":[],"title":"Windows SMB Client: untrusted pointer lets a local user gain higher privileges","description":"Untrusted pointer dereference in Windows SMB Client allows an authorized attacker to elevate privileges locally.","summary":"A flaw in the Windows SMB Client mishandles a pointer it does not trust, so a signed-in attacker can dereference it to raise their privileges on the same machine. The attacker gets administrator-level control of the affected Windows host, according to the NVD entry.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","patch-tuesday","smb","smb-client","windows"],"not_affected_if":["no-local-logon"],"how_to_check":"Run winver or Get-ComputerInfo to read your Windows build, then compare it with the fixed build for your version in the MSRC Security Update Guide entry for CVE-2026-119870 (November 2026 updates). Installing the November 2026 cumulative update is the expected remedy; confirm the KB on Microsoft's page.","fix":null,"status":"open","published_at":"2026-11-10T19:20:06+00:00","first_seen_at":"2026-11-10T19:25:00+00:00","triaged_at":"2026-11-10T19:51:38+00:00","updated_at":"2026-11-10T22:44:48+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:51:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows SMB Client: untrusted pointer lets a local user gain higher privileges","impact":"high","summary":"A flaw in the Windows SMB Client mishandles a pointer it does not trust, so a signed-in attacker can dereference it to raise their privileges on the same machine. The attacker gets administrator-level control of the affected Windows host, according to the NVD entry.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","smb"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows machine","analyst_note":"Find the affected Windows builds and the Microsoft patch in the security update guide for CVE-2026-119870; the NVD entry alone gives no version data.","how_to_check":"- Check the Windows build with `winver` or `Get-ComputerInfo` and compare it against the patched build listed by Microsoft.\n- Confirm whether the SMB client feature is in use with `Get-SmbConnection`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-logon"],"who_is_affected":"Windows machines with the SMB Client component, where an authorized local user could already sign in. The sources do not name the affected Windows builds or the patched build, so check Microsoft's security update guide for the exact range. Systems where no one can sign in locally carry less risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000719,"input_tokens":4492,"output_tokens":540,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and the Microsoft patch in the security update guide for CVE-2026-119870; the NVD entry alone gives no version data.","search":"'-119870':15A,18A '-2026':14A,17A 'accord':75B 'administr':67B 'administrator-level':66B 'affect':72B 'allow':87C 'attack':51B,64B,90C 'author':89C 'client':3A,30B,38B,86C 'control':69B 'cve':13A,16A 'derefer':53B,82C 'elev':92C 'entri':79B 'escal':23B 'flaw':33B 'gain':10A 'get':65B 'higher':11A 'host':74B 'infrastructur':19B 'let':6A 'level':68B 'local':8A,21B,94C 'local-privilege-escal':20B 'machin':62B 'mishandl':39B 'nvd':78B 'patch':25B 'patch-tuesday':24B 'pointer':5A,41B,81C 'privileg':12A,22B,58B,93C 'rais':56B 'sign':49B 'signed-in':48B 'smb':2A,27B,29B,37B,85C 'smb-client':28B 'trust':45B 'tuesday':26B 'untrust':4A,80C 'user':9A 'window':1A,31B,36B,73B,84C","nicknames":[],"mitigations":[],"who_affected":"Windows machines using the SMB client where an attacker already has a local low-privileged account. Microsoft's score (AV:L, AC:H, PR:L) means it is local only and hard to exploit, so remote attackers without a login are not in scope. Affected builds are not confirmed here; check the Security Update Guide entry for your Windows version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","patchtuesday","smb","smbclient","windows"],"campaign_type":null,"search_a":"'-119870':15A,18A '-2026':14A,17A 'client':3A 'cve':13A,16A 'gain':10A 'higher':11A 'let':6A 'local':8A 'pointer':5A 'privileg':12A 'smb':2A 'untrust':4A 'user':9A 'window':1A","search_b":"'accord':75B 'administr':67B 'administrator-level':66B 'affect':72B 'attack':51B,64B 'client':30B,38B 'control':69B 'derefer':53B 'entri':79B 'escal':23B 'flaw':33B 'get':65B 'host':74B 'infrastructur':19B 'level':68B 'local':21B 'local-privilege-escal':20B 'machin':62B 'mishandl':39B 'nvd':78B 'patch':25B 'patch-tuesday':24B 'pointer':41B 'privileg':22B,58B 'rais':56B 'sign':49B 'signed-in':48B 'smb':27B,29B,37B 'smb-client':28B 'trust':45B 'tuesday':26B 'window':31B,36B,73B","search_c":"'allow':87C 'attack':90C 'author':89C 'client':86C 'derefer':82C 'elev':92C 'local':94C 'pointer':81C 'privileg':93C 'smb':85C 'untrust':80C 'window':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119870","severity":null,"published_at":"2026-11-10T19:20:06+00:00","modified_at":"2026-11-10T19:20:06+00:00","first_seen_at":"2026-11-10T19:25:00+00:00","fetched_at":"2026-11-10T19:25:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119870:3033","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-119870","severity":null,"published_at":"2026-11-10T22:44:44+00:00","modified_at":"2026-11-10T22:44:48+00:00","first_seen_at":"2026-11-10T22:44:44+00:00","fetched_at":"2026-11-10T22:44:48+00:00","note":"Correction: who_affected is my reading of the CVSS vector (local, low privilege, high complexity), not the vendor's wording, so it should not carry a verified badge.","cites":["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-119870"]}],"documents":[{"id":119723,"url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-119870","title":"MSRC: CVE-2026-119870 Windows SMB Client Elevation of Privilege Vulnerability","kind":"advisory","source":"analyst","publisher":null,"text":"CVSS 3.1 7.0 Important (AV:L/AC:H/PR:L/UI:N/E:U/RL:O/RC:C). Exploited: No. Publicly disclosed: No. Exploitation Less Likely. Affected builds and KBs not in this data.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}