{"id":"CVE-2026-119881","kind":"vulnerability","aliases":["CVE-2026-119881"],"related":[],"title":"Microsoft XPS Document Converter: heap overflow lets attackers gain elevated privileges","description":"Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to elevate privileges over a network.","summary":"Heap-based buffer overflow in Microsoft XPS Document Converter lets an attacker raise privileges over a network (CVSS 8.8). The CNA vector is AV:N/PR:N/UI:R, so a user has to take an action first. Microsoft shipped fixes in the November 2026 updates. No exploitation or public PoC is known.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 Version 1607","fixed":["10.0.14393.9688"],"affected":">= 10.0.14393.0, < 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows 10 Version 1809","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 Version 21H2","fixed":["10.0.19044.7846"],"affected":">= 10.0.19044.0, < 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 Version 22H2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 Version 23H2","fixed":["10.0.22631.7711"],"affected":">= 10.0.22631.0, < 10.0.22631.7711","ecosystem":"vendor"}],"ecosystems":[],"tags":["other","user-interaction","windows","xps-document-converter"],"not_affected_if":[],"how_to_check":"Run winver or [System.Environment]::OSVersion in PowerShell and compare the build (major.UBR) with the fixed builds in the fix field. A build below the fixed one is affected. Check other Windows 11 and Server builds in the MSRC Security Update Guide.","fix":"Install the November 2026 Windows cumulative update. Fixed builds listed by a third party mirroring the CNA record: Win10 1607 10.0.14393.9688, 1809 10.0.17763.9487, 21H2 10.0.19044.7846, 22H2 10.0.19045.7846, Win11 23H2 10.0.22631.7711 (about 10 builds in total; the rest are not read). Confirm against the MSRC entry.","status":"open","published_at":"2026-11-10T19:20:07+00:00","first_seen_at":"2026-11-10T19:25:01+00:00","triaged_at":"2026-11-10T19:28:05+00:00","updated_at":"2026-11-10T22:42:46+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T19:28:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft XPS Document Converter: heap overflow lets attackers gain elevated privileges","impact":"high","summary":"A heap-based buffer overflow in Microsoft's XPS Document Converter lets an unauthorized attacker over the network raise their privileges. The NVD record gives a CVSS score of 8.8 and no further technical detail.","audience":"businesses","category":"other","nicknames":[],"who_cares":["windows","xps-document-converter"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker gains elevated privileges on the affected Windows machine","analyst_note":"Find Microsoft's security update guide entry for CVE-2026-119881 to confirm affected Windows versions, fixed builds and whether user interaction is required.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000642,"input_tokens":4506,"output_tokens":382,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Microsoft's security update guide entry for CVE-2026-119881 to confirm affected Windows versions, fixed builds and whether user interaction is required.","search":"'-119881':14A,17A '-2026':13A,16A '10':19A,23A,27A,31A '11':35A '1607':21A '1809':25A '2026':90B '21h2':29A '22h2':33A '23h2':37A '8.8':66B 'action':82B 'allow':109C 'attack':8A,59B,112C 'av':71B 'base':49B,101C 'buffer':50B,102C 'cna':68B 'convert':4A,46B,56B,108C 'cve':12A,15A 'cvss':65B 'document':3A,45B,55B,107C 'elev':10A,114C 'exploit':93B 'first':83B 'fix':86B 'gain':9A 'heap':5A,48B,100C 'heap-bas':47B,99C 'interact':41B 'known':98B 'let':7A,57B 'microsoft':1A,53B,84B,105C 'n/pr':72B 'n/ui':73B 'network':64B,118C 'novemb':89B 'overflow':6A,51B,103C 'poc':96B 'privileg':11A,61B,115C 'public':95B 'r':74B 'rais':60B 'ship':85B 'take':80B 'unauthor':111C 'updat':91B 'user':40B,77B 'user-interact':39B 'vector':69B 'version':20A,24A,28A,32A,36A 'window':42B 'windows':18A,22A,26A,30A,34A 'xps':2A,44B,54B,106C 'xps-document-convert':43B","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the XPS Document Converter component that have not installed the November 2026 updates. The vector needs user interaction, so the main risk is a user opening or printing a crafted document. Fully patched systems can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Install the latest Windows updates: Settings > Windows Update > Check for updates.","pkeys":["10version1607","10version1809","10version21h2","10version22h2","11version23h2","windows10version1607","windows10version1809","windows10version21h2","windows10version22h2","windows11version23h2"],"ptokens":["10","11","1607","1809","21h2","22h2","23h2","version","windows"],"labels":["high","other","userinteraction","windows","xpsdocumentconverter"],"campaign_type":null,"search_a":"'-119881':14A,17A '-2026':13A,16A '10':19A,23A,27A,31A '11':35A '1607':21A '1809':25A '21h2':29A '22h2':33A '23h2':37A 'attack':8A 'convert':4A 'cve':12A,15A 'document':3A 'elev':10A 'gain':9A 'heap':5A 'let':7A 'microsoft':1A 'overflow':6A 'privileg':11A 'version':20A,24A,28A,32A,36A 'windows':18A,22A,26A,30A,34A 'xps':2A","search_b":"'2026':90B '8.8':66B 'action':82B 'attack':59B 'av':71B 'base':49B 'buffer':50B 'cna':68B 'convert':46B,56B 'cvss':65B 'document':45B,55B 'exploit':93B 'first':83B 'fix':86B 'heap':48B 'heap-bas':47B 'interact':41B 'known':98B 'let':57B 'microsoft':53B,84B 'n/pr':72B 'n/ui':73B 'network':64B 'novemb':89B 'overflow':51B 'poc':96B 'privileg':61B 'public':95B 'r':74B 'rais':60B 'ship':85B 'take':80B 'updat':91B 'user':40B,77B 'user-interact':39B 'vector':69B 'window':42B 'xps':44B,54B 'xps-document-convert':43B","search_c":"'allow':109C 'attack':112C 'base':101C 'buffer':102C 'convert':108C 'document':107C 'elev':114C 'heap':100C 'heap-bas':99C 'microsoft':105C 'network':118C 'overflow':103C 'privileg':115C 'unauthor':111C 'xps':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119881","severity":null,"published_at":"2026-11-10T19:20:07+00:00","modified_at":"2026-11-10T19:20:07+00:00","first_seen_at":"2026-11-10T19:25:01+00:00","fetched_at":"2026-11-10T19:25:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119881:3028","url":"https://radar.offseq.com/threat/cve-2026-119881-cwe-122-heap-based-buffer-overflow-in-microsoft-windows-10-version-1607-ea80d9f75af9e689","severity":null,"published_at":"2026-11-10T22:42:46+00:00","modified_at":"2026-11-10T22:42:46+00:00","first_seen_at":"2026-11-10T22:42:46+00:00","fetched_at":"2026-11-10T22:42:46+00:00","note":"MSRC page is JS-only and returned no text, so nothing verified. Builds and vector come from OffSeq, which mirrors the CNA record (a rewrite). The vector has UI:R, so the user must act, which contradicts the earlier 'unauthorized, network' wording. No exploitation known.","cites":["https://radar.offseq.com/threat/cve-2026-119881-cwe-122-heap-based-buffer-overflow-in-microsoft-windows-10-version-1607-ea80d9f75af9e689"]}],"documents":[{"id":119718,"url":"https://radar.offseq.com/threat/cve-2026-119881-cwe-122-heap-based-buffer-overflow-in-microsoft-windows-10-version-1607-ea80d9f75af9e689","title":"OffSeq Threat Radar: CVE-2026-119881","kind":"other","source":"analyst","publisher":null,"text":"Mirrors CNA data: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, fixed builds Win10 1607 10.0.14393.9688, 1809 10.0.17763.9487, 21H2 10.0.19044.7846, 22H2 10.0.19045.7846, Win11 23H2 10.0.22631.7711 (+ others not listed). Not known exploited.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}