{"id":"CVE-2026-119918","kind":"vulnerability","aliases":["CVE-2026-119918"],"related":[],"title":"Windows Kernel: use-after-free lets a physical attacker gain higher privileges","description":"Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.","summary":"A use-after-free flaw in the Windows kernel lets an attacker who has physical access to a machine raise their privileges. The sources give no further detail on the exploit path.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","windows"],"not_affected_if":["physically-secured-devices"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:13+00:00","first_seen_at":"2026-11-10T19:25:03+00:00","triaged_at":"2026-11-10T19:55:36+00:00","updated_at":"2026-11-10T19:55:36+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:55:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Kernel: use-after-free lets a physical attacker gain higher privileges","impact":"high","summary":"A use-after-free flaw in the Windows kernel lets an attacker who has physical access to a machine raise their privileges. The sources give no further detail on the exploit path.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","endpoints"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker gains elevated privileges on the local Windows machine","analyst_note":"Find the Microsoft advisory for CVE-2026-119918 to get affected Windows builds, the fixed update, and the attack prerequisites.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["physically-secured-devices"],"who_is_affected":"Windows machines where an attacker can get physical access. The sources do not name affected Windows builds or the exact trigger. Machines that are physically secured and used only by trusted people are lower risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00066,"input_tokens":4489,"output_tokens":422,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119918':16A,19A '-2026':15A,18A 'access':39B 'allow':62C 'attack':10A,35B,65C,72C 'cve':14A,17A 'detail':51B 'elev':67C 'endpoint':20B 'exploit':54B 'flaw':28B 'free':6A,27B,58C 'gain':11A 'give':48B 'higher':12A 'infrastructur':21B 'kernel':2A,32B,61C 'let':7A,33B 'machin':42B 'path':55B 'physic':9A,38B,71C 'privileg':13A,45B,68C 'rais':43B 'sourc':47B 'unauthor':64C 'use':4A,25B,56C 'use-after-fre':3A,24B 'window':1A,22B,31B,60C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where an attacker can get physical access. The sources do not name affected Windows builds or the exact trigger. Machines that are physically secured and used only by trusted people are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["endpoints","infrastructure","medium","windows"],"campaign_type":null,"search_a":"'-119918':16A,19A '-2026':15A,18A 'attack':10A 'cve':14A,17A 'free':6A 'gain':11A 'higher':12A 'kernel':2A 'let':7A 'physic':9A 'privileg':13A 'use':4A 'use-after-fre':3A 'window':1A","search_b":"'access':39B 'attack':35B 'detail':51B 'endpoint':20B 'exploit':54B 'flaw':28B 'free':27B 'give':48B 'infrastructur':21B 'kernel':32B 'let':33B 'machin':42B 'path':55B 'physic':38B 'privileg':45B 'rais':43B 'sourc':47B 'use':25B 'use-after-fre':24B 'window':22B,31B","search_c":"'allow':62C 'attack':65C,72C 'elev':67C 'free':58C 'kernel':61C 'physic':71C 'privileg':68C 'unauthor':64C 'use':56C 'window':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119918","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119918","severity":null,"published_at":"2026-11-10T19:20:13+00:00","modified_at":"2026-11-10T19:20:13+00:00","first_seen_at":"2026-11-10T19:25:03+00:00","fetched_at":"2026-11-10T19:25:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}