{"id":"CVE-2026-119908","kind":"vulnerability","aliases":["CVE-2026-119908"],"related":[],"title":"Windows Storage Spaces Controller: integer underflow lets an unauthorized attacker run code","description":"Integer underflow (wrap or wraparound) in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network.","summary":"An integer underflow in the Windows Storage Spaces Controller lets an unauthorized attacker reach the component over the network. The sources say the attacker can execute code on the affected Windows machine.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","storage-spaces","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:11+00:00","first_seen_at":"2026-11-10T19:25:02+00:00","triaged_at":"2026-11-10T19:28:05+00:00","updated_at":"2026-11-10T19:28:05+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:28:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Storage Spaces Controller: integer underflow lets an unauthorized attacker run code","impact":"high","summary":"An integer underflow in the Windows Storage Spaces Controller lets an unauthorized attacker reach the component over the network. The sources say the attacker can execute code on the affected Windows machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","storage-spaces"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker executes code on the Windows machine over the network","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-119908 to confirm affected Windows builds, required configuration, and the patch.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Windows systems that run Storage Spaces, the feature that pools disks, are the relevant targets. The sources do not say which Windows versions or configurations are affected, or whether Storage Spaces must be in use. Teams without Windows file or storage servers can likely skip it, but the sources do not confirm that.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000685,"input_tokens":4507,"output_tokens":468,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-119908 to confirm affected Windows builds, required configuration, and the patch.","search":"'-119908':15A,18A '-2026':14A,17A 'affect':53B 'allow':66C 'attack':10A,36B,47B,69C 'code':12A,50B,72C 'compon':39B 'control':4A,32B,65C 'cve':13A,16A 'execut':49B,71C 'infrastructur':19B 'integ':5A,25B,56C 'let':7A,33B 'machin':55B 'network':42B,75C 'reach':37B 'run':11A 'say':45B 'sourc':44B 'space':3A,22B,31B,64C 'storag':2A,21B,30B,63C 'storage-spac':20B 'unauthor':9A,35B,68C 'underflow':6A,26B,57C 'window':1A,23B,29B,54B,62C 'wrap':58C 'wraparound':60C","nicknames":[],"mitigations":[],"who_affected":"Windows systems that run Storage Spaces, the feature that pools disks, are the relevant targets. The sources do not say which Windows versions or configurations are affected, or whether Storage Spaces must be in use. Teams without Windows file or storage servers can likely skip it, but the sources do not confirm that.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","storagespaces","windows"],"campaign_type":null,"search_a":"'-119908':15A,18A '-2026':14A,17A 'attack':10A 'code':12A 'control':4A 'cve':13A,16A 'integ':5A 'let':7A 'run':11A 'space':3A 'storag':2A 'unauthor':9A 'underflow':6A 'window':1A","search_b":"'affect':53B 'attack':36B,47B 'code':50B 'compon':39B 'control':32B 'execut':49B 'infrastructur':19B 'integ':25B 'let':33B 'machin':55B 'network':42B 'reach':37B 'say':45B 'sourc':44B 'space':22B,31B 'storag':21B,30B 'storage-spac':20B 'unauthor':35B 'underflow':26B 'window':23B,29B,54B","search_c":"'allow':66C 'attack':69C 'code':72C 'control':65C 'execut':71C 'integ':56C 'network':75C 'space':64C 'storag':63C 'unauthor':68C 'underflow':57C 'window':62C 'wrap':58C 'wraparound':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119908","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119908","severity":null,"published_at":"2026-11-10T19:20:11+00:00","modified_at":"2026-11-10T19:20:11+00:00","first_seen_at":"2026-11-10T19:25:02+00:00","fetched_at":"2026-11-10T19:25:02+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}