{"id":"CVE-2026-119871","kind":"vulnerability","aliases":["CVE-2026-119871"],"related":[],"title":"Windows IP Translation service use-after-free lets a local user gain privileges","description":"Use after free in Windows IP Translation Configuration Service allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in the Windows IP Translation Configuration Service lets an authorized local user elevate their privileges. An attacker who already has a logon on the machine can gain higher rights than they were given.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows IP Translation Configuration Service","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","windows"],"not_affected_if":["no-local-user-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:06+00:00","first_seen_at":"2026-11-10T19:25:00+00:00","triaged_at":"2026-11-10T19:58:20+00:00","updated_at":"2026-11-10T19:58:20+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:58:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows IP Translation service use-after-free lets a local user gain privileges","impact":"high","summary":"A use-after-free bug in the Windows IP Translation Configuration Service lets an authorized local user elevate their privileges. An attacker who already has a logon on the machine can gain higher rights than they were given.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains administrator-level privileges on the machine","analyst_note":"Find the Microsoft advisory for CVE-2026-119871 to confirm affected Windows builds, default service state and the patch.","how_to_check":"unknown","plain_action":"","product_name":"Windows IP Translation Configuration Service","needs_analyst":true,"not_affected_if":["no-local-user-access"],"who_is_affected":"Only Windows machines where the IP Translation Configuration Service is present and running are in scope, and an attacker must already be able to run code as a local user. The sources do not list affected Windows builds or whether the service is on by default, so the team should check its own Windows fleet against the vendor advisory.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000687,"input_tokens":4490,"output_tokens":477,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119871':17A,20A '-2026':16A,19A 'allow':76C 'alreadi':52B 'attack':50B,79C 'author':43B,78C 'bug':33B 'configur':39B,74C 'configuration':24A 'cve':15A,18A 'elev':46B,81C 'free':8A,32B,69C 'gain':13A,60B 'given':66B 'higher':61B 'infrastructur':26B 'ip':2A,22A,37B,72C 'let':9A,41B 'local':11A,44B,83C 'logon':55B 'machin':58B 'privileg':14A,48B,82C 'right':62B 'servic':4A,40B,75C 'service':25A 'translat':3A,38B,73C 'translation':23A 'use':6A,30B,67C 'use-after-fre':5A,29B 'user':12A,45B 'window':1A,27B,36B,71C 'windows':21A","nicknames":[],"mitigations":[],"who_affected":"Only Windows machines where the IP Translation Configuration Service is present and running are in scope, and an attacker must already be able to run code as a local user. The sources do not list affected Windows builds or whether the service is on by default, so the team should check its own Windows fleet against the vendor advisory.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["iptranslationconfigurationservice","windowsiptranslationconfigurationservice"],"ptokens":["configuration","ip","service","translation","windows"],"labels":["infrastructure","medium","vendor","windows"],"campaign_type":null,"search_a":"'-119871':17A,20A '-2026':16A,19A 'configuration':24A 'cve':15A,18A 'free':8A 'gain':13A 'ip':2A,22A 'let':9A 'local':11A 'privileg':14A 'servic':4A 'service':25A 'translat':3A 'translation':23A 'use':6A 'use-after-fre':5A 'user':12A 'window':1A 'windows':21A","search_b":"'alreadi':52B 'attack':50B 'author':43B 'bug':33B 'configur':39B 'elev':46B 'free':32B 'gain':60B 'given':66B 'higher':61B 'infrastructur':26B 'ip':37B 'let':41B 'local':44B 'logon':55B 'machin':58B 'privileg':48B 'right':62B 'servic':40B 'translat':38B 'use':30B 'use-after-fre':29B 'user':45B 'window':27B,36B","search_c":"'allow':76C 'attack':79C 'author':78C 'configur':74C 'elev':81C 'free':69C 'ip':72C 'local':83C 'privileg':82C 'servic':75C 'translat':73C 'use':67C 'window':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119871","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119871","severity":null,"published_at":"2026-11-10T19:20:06+00:00","modified_at":"2026-11-10T19:20:06+00:00","first_seen_at":"2026-11-10T19:25:00+00:00","fetched_at":"2026-11-10T19:25:00+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}