{"id":"CVE-2026-119876","kind":"vulnerability","aliases":["CVE-2026-119876"],"related":[],"title":"Windows USB Scanner Driver: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows USB Scanner Driver allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows USB Scanner Driver lets an attacker who already has a local account raise their privileges. The sources do not name affected versions or a fix.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows"],"not_affected_if":["no-untrusted-local-users","no-usb-scanner-driver"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:07+00:00","first_seen_at":"2026-11-10T19:25:00+00:00","triaged_at":"2026-11-10T19:51:34+00:00","updated_at":"2026-11-10T19:51:34+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:51:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows USB Scanner Driver: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows USB Scanner Driver lets an attacker who already has a local account raise their privileges. The sources do not name affected versions or a fix.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","local-privilege-escalation"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the Windows machine","analyst_note":"Find the affected Windows builds and the Microsoft security update for CVE-2026-119876 at the NVD entry or the Microsoft Security Response Center.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-usb-scanner-driver","no-untrusted-local-users"],"who_is_affected":"Windows machines with the USB Scanner Driver present are the systems to look at, and the attacker must already be authorized on the machine. The sources do not say which Windows versions or driver builds are affected, or whether the driver is installed by default. Systems without a USB scanner driver or without local user accounts open to untrusted people are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000695,"input_tokens":4500,"output_tokens":490,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and the Microsoft security update for CVE-2026-119876 at the NVD entry or the Microsoft Security Response Center.","search":"'-119876':16A,19A '-2026':15A,18A 'account':46B 'affect':55B 'allow':70C 'alreadi':42B 'attack':40B,73C 'author':72C 'base':29B,62C 'buffer':30B,63C 'cve':14A,17A 'driver':4A,37B,69C 'elev':75C 'escal':24B 'fix':59B 'gain':11A 'heap':5A,28B,61C 'heap-bas':27B,60C 'higher':12A 'infrastructur':20B 'let':7A,38B 'local':9A,22B,45B,77C 'local-privilege-escal':21B 'name':54B 'overflow':6A,31B,64C 'privileg':13A,23B,49B,76C 'rais':47B 'scanner':3A,36B,68C 'sourc':51B 'usb':2A,35B,67C 'user':10A 'version':56B 'window':1A,25B,34B,66C","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the USB Scanner Driver present are the systems to look at, and the attacker must already be authorized on the machine. The sources do not say which Windows versions or driver builds are affected, or whether the driver is installed by default. Systems without a USB scanner driver or without local user accounts open to untrusted people are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","windows"],"campaign_type":null,"search_a":"'-119876':16A,19A '-2026':15A,18A 'cve':14A,17A 'driver':4A 'gain':11A 'heap':5A 'higher':12A 'let':7A 'local':9A 'overflow':6A 'privileg':13A 'scanner':3A 'usb':2A 'user':10A 'window':1A","search_b":"'account':46B 'affect':55B 'alreadi':42B 'attack':40B 'base':29B 'buffer':30B 'driver':37B 'escal':24B 'fix':59B 'heap':28B 'heap-bas':27B 'infrastructur':20B 'let':38B 'local':22B,45B 'local-privilege-escal':21B 'name':54B 'overflow':31B 'privileg':23B,49B 'rais':47B 'scanner':36B 'sourc':51B 'usb':35B 'version':56B 'window':25B,34B","search_c":"'allow':70C 'attack':73C 'author':72C 'base':62C 'buffer':63C 'driver':69C 'elev':75C 'heap':61C 'heap-bas':60C 'local':77C 'overflow':64C 'privileg':76C 'scanner':68C 'usb':67C 'window':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119876","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119876","severity":null,"published_at":"2026-11-10T19:20:07+00:00","modified_at":"2026-11-10T19:20:07+00:00","first_seen_at":"2026-11-10T19:25:00+00:00","fetched_at":"2026-11-10T19:25:00+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}