{"id":"CVE-2026-119916","kind":"vulnerability","aliases":["CVE-2026-119916"],"related":[],"title":"Windows Input System: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Input System allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Input System lets an attacker who already has a local account raise their privileges. The attacker gets the rights of a higher-privileged user or the system itself.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Input System","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local-accounts","terminal-server","windows"],"not_affected_if":["no-untrusted-local-users","single-user-machine"],"how_to_check":"Run winver (or [Environment]::OSVersion) to get the full build number, e.g. 10.0.19045.xxxx. You are exposed if it is below the fixed build for your release (see fix). Windows Update history should show the November 2026 cumulative update (e.g. KB5131096 for Win10 ESU).","fix":"Install the November 2026 cumulative update (Patch Tuesday, 10 Nov 2026). Fixed builds: Win10 1809/Server 2019 10.0.17763.9487, Win10 21H2 19044.7846, Win10 22H2 19045.7846, Win11 23H2 22631.7711, Win11 24H2 26100.9974, Win11 25H2 26200.9974, Win11 26H1 28000.3501, Win11 26H2 26300.9974, Server 2022 20348.5870, Server 2025 26100.33822. Confirm against MSRC.","status":"open","published_at":"2026-11-10T19:20:13+00:00","first_seen_at":"2026-11-10T19:25:02+00:00","triaged_at":"2026-11-10T19:28:05+00:00","updated_at":"2026-11-10T22:23:10+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:28:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Input System: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Input System lets an attacker who already has a local account raise their privileges. The attacker gets the rights of a higher-privileged user or the system itself.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","local-accounts","terminal-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the machine","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-119916 to confirm affected Windows builds, the patched build and whether a fix is available.","how_to_check":"- Run `winver` to see the Windows build and compare it with the patched build in Microsoft's advisory for CVE-2026-119916\n- Check Windows Update history for the latest cumulative update installed\n- unknown whether the sources name a specific affected build","plain_action":"","product_name":"Windows Input System","needs_analyst":true,"not_affected_if":["single-user-machine","no-untrusted-local-users"],"who_is_affected":"Any Windows machine where someone can log in locally is potentially exposed, since the attacker must already be authorized on the system. Shared workstations, terminal servers and multi-user hosts carry the most risk. Machines with only a single trusted user have less exposure. unknown which Windows versions the sources list as affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4488,"output_tokens":581,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-119916 to confirm affected Windows builds, the patched build and whether a fix is available.","search":"'-119916':15A,18A '-2026':14A,17A '10':23A,28A,31A '11':34A,37A,40A,43A,46A '1809':24A '2019':26A '2022':50A '2025':53A '21h2':29A '22h2':32A '23h2':35A '24h2':38A '25h2':41A '26h1':44A '26h2':47A 'account':57B,81B 'allow':108C 'alreadi':77B 'attack':75B,86B,111C 'author':110C 'base':65B,101C 'buffer':66B,102C 'cve':13A,16A 'elev':113C 'gain':10A 'get':87B 'heap':4A,64B,100C 'heap-bas':63B,99C 'higher':11A,93B 'higher-privileg':92B 'infrastructur':54B 'input':2A,20A,71B,106C 'let':6A,73B 'local':8A,56B,80B,115C 'local-account':55B 'overflow':5A,67B,103C 'privileg':12A,84B,94B,114C 'rais':82B 'right':89B 'server':25A,49A,52A,60B 'system':3A,21A,72B,98B,107C 'termin':59B 'terminal-serv':58B 'user':9A,95B 'window':1A,61B,70B,105C 'windows':19A,22A,27A,30A,33A,36A,39A,42A,45A,48A,51A","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10, Windows 11 or Windows Server 2019/2022/2025 machine below the fixed build is affected, but the attacker must already have a local account. Shared workstations, terminal/RDS servers and multi-user hosts carry the most risk. Single-user machines with no untrusted local accounts can patch on the normal schedule.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","inputsystem","server2022","server2025","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsinputsystem","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1809","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","input","server","system","windows"],"labels":["high","infrastructure","localaccounts","terminalserver","vendor","windows"],"campaign_type":null,"search_a":"'-119916':15A,18A '-2026':14A,17A '10':23A,28A,31A '11':34A,37A,40A,43A,46A '1809':24A '2019':26A '2022':50A '2025':53A '21h2':29A '22h2':32A '23h2':35A '24h2':38A '25h2':41A '26h1':44A '26h2':47A 'cve':13A,16A 'gain':10A 'heap':4A 'higher':11A 'input':2A,20A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'server':25A,49A,52A 'system':3A,21A 'user':9A 'window':1A 'windows':19A,22A,27A,30A,33A,36A,39A,42A,45A,48A,51A","search_b":"'account':57B,81B 'alreadi':77B 'attack':75B,86B 'base':65B 'buffer':66B 'get':87B 'heap':64B 'heap-bas':63B 'higher':93B 'higher-privileg':92B 'infrastructur':54B 'input':71B 'let':73B 'local':56B,80B 'local-account':55B 'overflow':67B 'privileg':84B,94B 'rais':82B 'right':89B 'server':60B 'system':72B,98B 'termin':59B 'terminal-serv':58B 'user':95B 'window':61B,70B","search_c":"'allow':108C 'attack':111C 'author':110C 'base':101C 'buffer':102C 'elev':113C 'heap':100C 'heap-bas':99C 'input':106C 'local':115C 'overflow':103C 'privileg':114C 'system':107C 'window':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119916","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119916","severity":null,"published_at":"2026-11-10T19:20:13+00:00","modified_at":"2026-11-10T19:20:13+00:00","first_seen_at":"2026-11-10T19:25:02+00:00","fetched_at":"2026-11-10T19:25:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119916:2968","url":"https://cve.imfht.com/detail/CVE-2026-119916","severity":null,"published_at":"2026-11-10T22:23:10+00:00","modified_at":"2026-11-10T22:23:10+00:00","first_seen_at":"2026-11-10T22:23:10+00:00","fetched_at":"2026-11-10T22:23:10+00:00","note":"MSRC page is JS-only and unreadable here, so no primary doc linked and nothing marked verified. Build matrix is from a CVE List V5 mirror (cve.imfht.com) and OffSeq; BleepingComputer confirms Windows 10 22H2 19045.7846 and LTSC 2021 19044.7846 from the Nov 2026 Patch Tuesday. No exploitation or PoC reported. Search worked; X not checked.","cites":["https://cve.imfht.com/detail/CVE-2026-119916","https://radar.offseq.com/threat/cve-2026-119916-cwe-122-heap-based-buffer-overflow-in-microsoft-windows-10-version-1809-348ec496837259a4"]}],"documents":[{"id":119464,"url":"https://cve.imfht.com/detail/CVE-2026-119916","title":"CVE-2026-119916 (CVE List V5 mirror, affected build matrix)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":119465,"url":"https://radar.offseq.com/threat/cve-2026-119916-cwe-122-heap-based-buffer-overflow-in-microsoft-windows-10-version-1809-348ec496837259a4","title":"OffSeq Threat Radar: CVE-2026-119916","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":117830,"url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5131096-extended-security-update/","title":"Windows 10 KB5131096 ESU (Nov 2026 Patch Tuesday)","kind":"blog","source":"blog","publisher":null,"text":"Microsoft releases Windows 10 KB5131096 extended security update\n\nMicrosoft released the Windows 10 KB5131096 extended security update, which includes this month's November 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]","published_at":"2026-11-10T20:04:36+00:00","relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}