{"id":"CVE-2026-119898","kind":"vulnerability","aliases":["CVE-2026-119898"],"related":[],"title":"Windows: print workflow service null pointer lets a local user gain privileges","description":"Null pointer dereference in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.","summary":"A null pointer dereference in the Windows PrintWorkflowUserSvc service lets an attacker who already has a local account raise their privileges. The sources do not describe a remote path.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows PrintWorkflowUserSvc","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:10+00:00","first_seen_at":"2026-11-10T19:25:01+00:00","triaged_at":"2026-11-10T19:51:30+00:00","updated_at":"2026-11-10T19:51:30+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:51:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: print workflow service null pointer lets a local user gain privileges","impact":"high","summary":"A null pointer dereference in the Windows PrintWorkflowUserSvc service lets an attacker who already has a local account raise their privileges. The sources do not describe a remote path.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher system privileges on the Windows machine","analyst_note":"Find the Microsoft advisory for CVE-2026-119898 to confirm affected Windows builds, fixed updates and any detection steps.","how_to_check":"- unknown","plain_action":"","product_name":"Windows PrintWorkflowUserSvc","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Windows machines running the PrintWorkflowUserSvc print workflow service are exposed, and an attacker needs an authorized local account first. The sources do not say which Windows builds are affected or which are patched.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000673,"input_tokens":4502,"output_tokens":446,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft advisory for CVE-2026-119898 to confirm affected Windows builds, fixed updates and any detection steps.","search":"'-119898':15A,18A '-2026':14A,17A 'account':40B 'allow':58C 'alreadi':36B 'attack':34B,61C 'author':60C 'cve':13A,16A 'derefer':26B,54C 'describ':48B 'elev':63C 'gain':11A 'infrastructur':21B 'let':7A,32B 'local':9A,39B,65C 'null':5A,24B,52C 'path':51B 'pointer':6A,25B,53C 'print':2A 'printworkflowusersvc':20A,30B,57C 'privileg':12A,43B,64C 'rais':41B 'remot':50B 'servic':4A,31B 'sourc':45B 'user':10A 'window':1A,22B,29B,56C 'windows':19A 'workflow':3A","nicknames":[],"mitigations":[],"who_affected":"Windows machines running the PrintWorkflowUserSvc print workflow service are exposed, and an attacker needs an authorized local account first. The sources do not say which Windows builds are affected or which are patched.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["printworkflowusersvc","windowsprintworkflowusersvc"],"ptokens":["printworkflowusersvc","windows"],"labels":["high","infrastructure","vendor","windows"],"campaign_type":null,"search_a":"'-119898':15A,18A '-2026':14A,17A 'cve':13A,16A 'gain':11A 'let':7A 'local':9A 'null':5A 'pointer':6A 'print':2A 'printworkflowusersvc':20A 'privileg':12A 'servic':4A 'user':10A 'window':1A 'windows':19A 'workflow':3A","search_b":"'account':40B 'alreadi':36B 'attack':34B 'derefer':26B 'describ':48B 'infrastructur':21B 'let':32B 'local':39B 'null':24B 'path':51B 'pointer':25B 'printworkflowusersvc':30B 'privileg':43B 'rais':41B 'remot':50B 'servic':31B 'sourc':45B 'window':22B,29B","search_c":"'allow':58C 'attack':61C 'author':60C 'derefer':54C 'elev':63C 'local':65C 'null':52C 'pointer':53C 'printworkflowusersvc':57C 'privileg':64C 'window':56C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119898","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119898","severity":null,"published_at":"2026-11-10T19:20:10+00:00","modified_at":"2026-11-10T19:20:10+00:00","first_seen_at":"2026-11-10T19:25:01+00:00","fetched_at":"2026-11-10T19:25:01+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}