{"id":"CVE-2026-119913","kind":"vulnerability","aliases":["CVE-2026-119913"],"related":[],"title":"Windows Print Spooler: link following lets local users gain higher privileges","description":"Improper link resolution before file access ('link following') in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.","summary":"Windows Print Spooler Components follow symbolic or junction links before accessing files, so a local user with some access can redirect file operations. An authorized attacker can use this to elevate privileges on the machine.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","print-spooler","windows"],"not_affected_if":["no-local-users"],"how_to_check":"- Check the Windows build with `winver` and compare it against the fixed build in Microsoft's advisory for CVE-2026-119913 (unknown from these sources)\n- Confirm the Print Spooler service state with `Get-Service Spooler` (unknown whether this is the trigger)","fix":null,"status":"open","published_at":"2026-11-10T19:20:12+00:00","first_seen_at":"2026-11-10T19:25:02+00:00","triaged_at":"2026-11-10T19:51:30+00:00","updated_at":"2026-11-10T19:51:30+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:51:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Print Spooler: link following lets local users gain higher privileges","impact":"high","summary":"Windows Print Spooler Components follow symbolic or junction links before accessing files, so a local user with some access can redirect file operations. An authorized attacker can use this to elevate privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","print-spooler"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows machine","analyst_note":"Find the affected Windows builds and the Microsoft fixed versions for CVE-2026-119913 from the NVD entry or Microsoft's security update guide.","how_to_check":"- Check the Windows build with `winver` and compare it against the fixed build in Microsoft's advisory for CVE-2026-119913 (unknown from these sources)\n- Confirm the Print Spooler service state with `Get-Service Spooler` (unknown whether this is the trigger)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Affects Windows machines where a user already has an authorized local account. The sources do not name the affected Windows versions or whether the Spooler must be running. Systems with no local untrusted users carry less exposure.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000709,"input_tokens":4492,"output_tokens":519,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and the Microsoft fixed versions for CVE-2026-119913 from the NVD entry or Microsoft's security update guide.","search":"'-119913':14A,17A '-2026':13A,16A 'access':33B,41B,63C 'allow':71C 'attack':48B,74C 'author':47B,73C 'compon':26B,70C 'cve':12A,15A 'elev':53B,76C 'file':34B,44B,62C 'follow':5A,27B,65C 'gain':9A 'higher':10A 'improp':58C 'infrastructur':18B 'junction':30B 'let':6A 'link':4A,31B,59C,64C 'local':7A,37B,78C 'machin':57B 'oper':45B 'print':2A,20B,24B,68C 'print-spool':19B 'privileg':11A,54B,77C 'redirect':43B 'resolut':60C 'spooler':3A,21B,25B,69C 'symbol':28B 'use':50B 'user':8A,38B 'window':1A,22B,23B,67C","nicknames":[],"mitigations":[],"who_affected":"Affects Windows machines where a user already has an authorized local account. The sources do not name the affected Windows versions or whether the Spooler must be running. Systems with no local untrusted users carry less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","printspooler","windows"],"campaign_type":null,"search_a":"'-119913':14A,17A '-2026':13A,16A 'cve':12A,15A 'follow':5A 'gain':9A 'higher':10A 'let':6A 'link':4A 'local':7A 'print':2A 'privileg':11A 'spooler':3A 'user':8A 'window':1A","search_b":"'access':33B,41B 'attack':48B 'author':47B 'compon':26B 'elev':53B 'file':34B,44B 'follow':27B 'infrastructur':18B 'junction':30B 'link':31B 'local':37B 'machin':57B 'oper':45B 'print':20B,24B 'print-spool':19B 'privileg':54B 'redirect':43B 'spooler':21B,25B 'symbol':28B 'use':50B 'user':38B 'window':22B,23B","search_c":"'access':63C 'allow':71C 'attack':74C 'author':73C 'compon':70C 'elev':76C 'file':62C 'follow':65C 'improp':58C 'link':59C,64C 'local':78C 'print':68C 'privileg':77C 'resolut':60C 'spooler':69C 'window':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119913","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119913","severity":null,"published_at":"2026-11-10T19:20:12+00:00","modified_at":"2026-11-10T19:20:12+00:00","first_seen_at":"2026-11-10T19:25:02+00:00","fetched_at":"2026-11-10T19:25:02+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}