---
id: "CVE-2026-119908"
page: "https://infrastack.ai/live/CVE-2026-119908"
kind: "vulnerability"
aliases: ["CVE-2026-119908"]
title: "Windows Storage Spaces Controller: integer underflow allows remote code execution (Nov 2026 Patch Tuesday)"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": ">= 10.0.22631.0, < 10.0.22631.7711", "ecosystem": "vendor"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": ">= 10.0.26100.0, < 10.0.26100.9974", "ecosystem": "vendor"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9974"], "affected": ">= 10.0.26200.0, < 10.0.26200.9974", "ecosystem": "vendor"}, {"name": "Windows 11 26H1", "fixed": ["10.0.28000.3501"], "affected": ">= 10.0.28000.0, < 10.0.28000.3501", "ecosystem": "vendor"}, {"name": "Windows 11 26H2", "fixed": ["10.0.26300.9974"], "affected": ">= 10.0.26300.0, < 10.0.26300.9974", "ecosystem": "vendor"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": ">= 10.0.20348.0, < 10.0.20348.5870", "ecosystem": "vendor"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": ">= 10.0.26100.0, < 10.0.26100.33822", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "storage-spaces", "windows", "windows-11", "windows-server"]
not_affected_if: ["patched-build", "unknown"]
published_at: "2026-11-10T19:20:11+00:00"
first_seen_at: "2026-11-10T19:25:02+00:00"
updated_at: "2026-11-10T22:23:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119908", "first_seen_at": "2026-11-10T19:25:02+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-119908", "first_seen_at": "2026-11-10T22:23:08+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-119908"]}]
exploit_sources: []
---

# Windows Storage Spaces Controller: integer underflow allows remote code execution (Nov 2026 Patch Tuesday)

Link for people: https://infrastack.ai/live/CVE-2026-119908 (this .md is for agents)

An integer underflow in the Windows Storage Spaces Controller lets an unauthorized attacker reach the component over the network. The sources say the attacker can execute code on the affected Windows machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows 11 23H2 affected >= 10.0.22631.0, < 10.0.22631.7711 fixed 10.0.22631.7711
- vendor:Windows 11 24H2 affected >= 10.0.26100.0, < 10.0.26100.9974 fixed 10.0.26100.9974
- vendor:Windows 11 25H2 affected >= 10.0.26200.0, < 10.0.26200.9974 fixed 10.0.26200.9974
- vendor:Windows 11 26H1 affected >= 10.0.28000.0, < 10.0.28000.3501 fixed 10.0.28000.3501
- vendor:Windows 11 26H2 affected >= 10.0.26300.0, < 10.0.26300.9974 fixed 10.0.26300.9974
- vendor:Windows Server 2022 affected >= 10.0.20348.0, < 10.0.20348.5870 fixed 10.0.20348.5870
- vendor:Windows Server 2025 affected >= 10.0.26100.0, < 10.0.26100.33822 fixed 10.0.26100.33822

## How to check

Run winver or 'cmd /c ver' and compare the build number with the fixed builds in the fix field; anything lower is affected. Which configurations are exposed (for example whether Storage Spaces must be in use) is unknown until the MSRC page is read.

## Fix

Install the November 2026 Windows cumulative update. Fixed builds per Microsoft's CVE record (via OpenCVE mirror): Win11 23H2 10.0.22631.7711, 24H2 10.0.26100.9974, 25H2 10.0.26200.9974, 26H1 10.0.28000.3501, 26H2 10.0.26300.9974, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822. Confirm on the MSRC page.

## Timeline

- 2026-11-10T19:25:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119908
- 2026-11-10T22:23:08+00:00 analyst https://app.opencve.io/cve/CVE-2026-119908 — MSRC page is JS-only and unreadable here; builds taken from OpenCVE mirror of Microsoft's CVE record (not primary), nothing marked verified. Re-check MSRC page for configuration needs, exploitability and KB numbers.

## Documents

- [describes] OpenCVE mirror of Microsoft CVE record CVE-2026-119908 https://app.opencve.io/cve/CVE-2026-119908

## From the sources

Integer underflow (wrap or wraparound) in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_