---
id: "CVE-2026-119898"
page: "https://infrastack.ai/live/CVE-2026-119898"
kind: "vulnerability"
aliases: ["CVE-2026-119898"]
title: "Windows: print workflow service null pointer lets a local user gain privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 10 21H2", "fixed": ["10.0.19044.7846"], "affected": "< 10.0.19044.7846", "ecosystem": "vendor"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": "< 10.0.19045.7846", "ecosystem": "vendor"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": "< 10.0.22631.7711", "ecosystem": "vendor"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": "< 10.0.26100.9974", "ecosystem": "vendor"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9974"], "affected": "< 10.0.26200.9974", "ecosystem": "vendor"}, {"name": "Windows 11 26H2", "fixed": ["10.0.26300.9974"], "affected": "< 10.0.26300.9974", "ecosystem": "vendor"}, {"name": "Windows 11 26H1", "fixed": ["10.0.28000.3501"], "affected": "< 10.0.28000.3501", "ecosystem": "vendor"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": "< 10.0.20348.5870", "ecosystem": "vendor"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": "< 10.0.26100.33822", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "local-privilege-escalation", "print", "windows"]
not_affected_if: ["patched-build", "unknown"]
published_at: "2026-11-10T19:20:10+00:00"
first_seen_at: "2026-11-10T19:25:01+00:00"
updated_at: "2026-11-10T22:26:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119898", "first_seen_at": "2026-11-10T19:25:01+00:00"}, {"source": "analyst", "url": "https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-119898.json", "first_seen_at": "2026-11-10T22:26:26+00:00", "cites": ["https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-119898.json"]}]
exploit_sources: []
---

# Windows: print workflow service null pointer lets a local user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-119898 (this .md is for agents)

A null pointer dereference in the Windows PrintWorkflowUserSvc service lets an attacker who already has a local account raise their privileges. The sources do not describe a remote path.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows 10 21H2 affected < 10.0.19044.7846 fixed 10.0.19044.7846
- vendor:Windows 10 22H2 affected < 10.0.19045.7846 fixed 10.0.19045.7846
- vendor:Windows 11 23H2 affected < 10.0.22631.7711 fixed 10.0.22631.7711
- vendor:Windows 11 24H2 affected < 10.0.26100.9974 fixed 10.0.26100.9974
- vendor:Windows 11 25H2 affected < 10.0.26200.9974 fixed 10.0.26200.9974
- vendor:Windows 11 26H2 affected < 10.0.26300.9974 fixed 10.0.26300.9974
- vendor:Windows 11 26H1 affected < 10.0.28000.3501 fixed 10.0.28000.3501
- vendor:Windows Server 2022 affected < 10.0.20348.5870 fixed 10.0.20348.5870
- vendor:Windows Server 2025 affected < 10.0.26100.33822 fixed 10.0.26100.33822

## How to check

Run winver or [System.Environment]::OSVersion / (Get-ComputerInfo).OsBuildNumber with UBR from 'reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR'; if the full build (e.g. 10.0.26100.xxxx) is below the fixed build for your Windows version, you are exposed. Service name is PrintWorkflowUserSvc (a per-user service, present by default). Also check Windows versions not in the list above against the MSRC page.

## Fix

Install the November 10, 2026 Windows security update so the build is at or above: Win10 21H2 10.0.19044.7846, Win10 22H2 10.0.19045.7846, Win11 23H2 10.0.22631.7711, Win11 24H2 10.0.26100.9974, Win11 25H2 10.0.26200.9974, Win11 26H2 10.0.26300.9974, Win11 26H1 10.0.28000.3501, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822. Microsoft marks customer action as required.

## Timeline

- 2026-11-10T19:25:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119898
- 2026-11-10T22:26:26+00:00 analyst https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-119898.json — Read MSRC CSAF (vendor): Important EoP, fixed by the Nov 10 2026 cumulative update; per-build fixed versions listed. CSAF text was truncated after Win11 26H1, so later rows (e.g. Server 2019/2016, 11 26H1 ARM/x64 beyond 10.0.28000.3501) and KB numbers not read. No exploitation info seen; no remote path.

## Documents

- [advisory] MSRC CSAF CVE-2026-119898 Windows PrintWorkflowUserSvc EoP https://msrc.microsoft.com/csaf/advisories/2026/msrc_cve-2026-119898.json

## From the sources

Null pointer dereference in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_