{"id":"CVE-2026-119917","kind":"vulnerability","aliases":["CVE-2026-119917"],"related":[],"title":"Windows Distributed Transaction Coordinator: heap overflow lets a local user gain elevated privileges","description":"Heap-based buffer overflow in Windows Distributed Transaction Coordinator allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Distributed Transaction Coordinator service lets an attacker who already has an authorized local account raise their privileges. The sources give a CVSS score of 7.8 and describe only a local attack path.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":">= 10.0.14393.0, < 10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":">= 10.0.19044.0, < 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">= 10.0.22631.0, < 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":">= 10.0.26100.0, < 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":">= 10.0.26200.0, < 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":">= 10.0.28000.0, < 10.0.28000.3501","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":">= 10.0.26300.0, < 10.0.26300.9974","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":">= 10.0.20348.0, < 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","msdtc","windows"],"not_affected_if":[],"how_to_check":"Run winver or (Get-ComputerInfo).OsBuildNumber and compare the full build (e.g. 10.0.26100.x) with the fixed builds in the product rows. Builds below the fixed build are affected. Also see whether the MSDTC service runs: Get-Service MSDTC. Whether a stopped service avoids the bug is not confirmed.","fix":"Install the November 2026 Windows cumulative update that raises the build to at least the fixed build for your version (e.g. Windows 11 24H2 10.0.26100.9974, Server 2025 10.0.26100.33822, Server 2022 10.0.20348.5870). KB numbers not read yet.","status":"open","published_at":"2026-11-10T19:20:13+00:00","first_seen_at":"2026-11-10T19:25:03+00:00","triaged_at":"2026-11-10T19:40:14+00:00","updated_at":"2026-11-10T22:23:40+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:40:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Distributed Transaction Coordinator: heap overflow lets a local user gain elevated privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Distributed Transaction Coordinator service lets an attacker who already has an authorized local account raise their privileges. The sources give a CVSS score of 7.8 and describe only a local attack path.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","msdtc"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level control of the Windows machine","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-119917 to confirm affected Windows builds, the patch, and any named MSDTC setting.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Affects Windows systems running the Distributed Transaction Coordinator component, where a user already holds an authorized account. The sources do not list affected Windows builds, so unknown which versions are in scope. Systems without an untrusted local user population are lower priority, but the sources do not say more.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00069,"input_tokens":4504,"output_tokens":480,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-119917 to confirm affected Windows builds, the patch, and any named MSDTC setting.","search":"'-119917':16A,19A '-2026':15A,18A '10':21A,26A,31A,34A '11':37A,40A,43A,46A,49A '1607':22A '1809':27A '2016':24A '2019':29A '2022':53A '2025':56A '21h2':32A '22h2':35A '23h2':38A '24h2':41A '25h2':44A '26h1':47A '26h2':50A '7.8':97B 'account':86B 'allow':115C 'alreadi':81B 'attack':79B,103B,118C 'author':84B,117C 'base':67B,107C 'buffer':68B,108C 'coordin':4A,75B,114C 'cve':14A,17A 'cvss':94B 'describ':99B 'distribut':2A,73B,112C 'elev':12A,120C 'escal':61B 'gain':11A 'give':92B 'heap':5A,66B,106C 'heap-bas':65B,105C 'infrastructur':57B 'let':7A,77B 'local':9A,59B,85B,102B,122C 'local-privilege-escal':58B 'msdtc':62B 'overflow':6A,69B,109C 'path':104B 'privileg':13A,60B,89B,121C 'rais':87B 'score':95B 'server':23A,28A,52A,55A 'servic':76B 'sourc':91B 'transact':3A,74B,113C 'user':10A 'window':1A,63B,72B,111C 'windows':20A,25A,30A,33A,36A,39A,42A,45A,48A,51A,54A","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10, Windows 11 or Windows Server 2016-2025 machine below the fixed build is affected. An attacker needs to already have a low-privilege local account, so the main risk is shared hosts, build servers, RDP/terminal servers and workstations where an attacker has a foothold. Single-user machines with no untrusted local code carry less risk but should still patch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","msdtc","windows"],"campaign_type":null,"search_a":"'-119917':16A,19A '-2026':15A,18A '10':21A,26A,31A,34A '11':37A,40A,43A,46A,49A '1607':22A '1809':27A '2016':24A '2019':29A '2022':53A '2025':56A '21h2':32A '22h2':35A '23h2':38A '24h2':41A '25h2':44A '26h1':47A '26h2':50A 'coordin':4A 'cve':14A,17A 'distribut':2A 'elev':12A 'gain':11A 'heap':5A 'let':7A 'local':9A 'overflow':6A 'privileg':13A 'server':23A,28A,52A,55A 'transact':3A 'user':10A 'window':1A 'windows':20A,25A,30A,33A,36A,39A,42A,45A,48A,51A,54A","search_b":"'7.8':97B 'account':86B 'alreadi':81B 'attack':79B,103B 'author':84B 'base':67B 'buffer':68B 'coordin':75B 'cvss':94B 'describ':99B 'distribut':73B 'escal':61B 'give':92B 'heap':66B 'heap-bas':65B 'infrastructur':57B 'let':77B 'local':59B,85B,102B 'local-privilege-escal':58B 'msdtc':62B 'overflow':69B 'path':104B 'privileg':60B,89B 'rais':87B 'score':95B 'servic':76B 'sourc':91B 'transact':74B 'window':63B,72B","search_c":"'allow':115C 'attack':118C 'author':117C 'base':107C 'buffer':108C 'coordin':114C 'distribut':112C 'elev':120C 'heap':106C 'heap-bas':105C 'local':122C 'overflow':109C 'privileg':121C 'transact':113C 'window':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119917","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119917","severity":null,"published_at":"2026-11-10T19:20:13+00:00","modified_at":"2026-11-10T19:20:13+00:00","first_seen_at":"2026-11-10T19:25:03+00:00","fetched_at":"2026-11-10T19:25:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119917:2967","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119917","severity":null,"published_at":"2026-11-10T22:23:40+00:00","modified_at":"2026-11-10T22:23:40+00:00","first_seen_at":"2026-11-10T22:23:40+00:00","fetched_at":"2026-11-10T22:23:40+00:00","note":"NVD page (Microsoft CNA data) gives affected builds; MSRC Update Guide page is JS-only and returned empty, so nothing verified, no KB numbers, no MSDTC setting found. No exploitation or PoC seen (not searched on X; B tier).","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-119917"]}],"documents":[{"id":119468,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119917","title":"NVD: CVE-2026-119917 (Microsoft CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}