{"id":"CVE-2026-119919","kind":"vulnerability","aliases":["CVE-2026-119919"],"related":[],"title":"Windows Distributed Transaction Coordinator: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Distributed Transaction Coordinator allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Distributed Transaction Coordinator service lets an authorized attacker with local access raise their privileges. The sources give a CVSS score of 7.0 and describe no remote trigger.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"windows","fixed":["10.0.14393.9688","10.0.17763.9487","10.0.19044.7846","10.0.19045.7846","10.0.22631.7711","10.0.26100.9974","10.0.26200.9974","10.0.28000.3501","10.0.26300.9974","10.0.20348.5870","10.0.26100.33822"],"affected":"Win10/11 and Server 2016-2025 below Nov 2026 builds (see fix)","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","local","msdtc","privilege-escalation","windows"],"not_affected_if":["patched-nov-2026"],"how_to_check":"Run winver or [Environment]::OSVersion / (Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').UBR and compare the full build number with the fixed builds listed in fix. Lower means unpatched. Whether MSDTC must be running to reach the flaw is not stated in the sources; also check 'Get-Service MSDTC'.","fix":"Install the November 2026 (10 Nov) Windows cumulative update. Fixed builds: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. Source: Microsoft record as mirrored by OpenCVE.","status":"open","published_at":"2026-11-10T19:20:13+00:00","first_seen_at":"2026-11-10T19:25:03+00:00","triaged_at":"2026-11-10T19:51:29+00:00","updated_at":"2026-11-10T22:22:08+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:51:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Distributed Transaction Coordinator: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Distributed Transaction Coordinator service lets an authorized attacker with local access raise their privileges. The sources give a CVSS score of 7.0 and describe no remote trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","msdtc"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119919 for affected Windows builds, the patch, and whether MSDTC must be enabled.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows systems that run the Distributed Transaction Coordinator service, where a user already has a local account, are the exposed case. The sources do not say which Windows versions are affected or whether the service must be running for the flaw to be reachable. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00068,"input_tokens":4504,"output_tokens":459,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119919 for affected Windows builds, the patch, and whether MSDTC must be enabled.","search":"'-119919':16A,19A '-2026':15A,18A '7.0':58B 'access':47B 'allow':74C 'attack':44B,77C 'author':43B,76C 'base':31B,66C 'buffer':32B,67C 'coordin':4A,39B,73C 'cve':14A,17A 'cvss':55B 'describ':60B 'distribut':2A,37B,71C 'elev':79C 'escal':26B 'gain':11A 'give':53B 'heap':5A,30B,65C 'heap-bas':29B,64C 'higher':12A 'infrastructur':21B 'let':7A,41B 'local':9A,22B,46B,81C 'msdtc':23B 'overflow':6A,33B,68C 'privileg':13A,25B,50B,80C 'privilege-escal':24B 'rais':48B 'remot':62B 'score':56B 'servic':40B 'sourc':52B 'transact':3A,38B,72C 'trigger':63B 'user':10A 'window':1A,27B,36B,70C 'windows':20A","nicknames":[],"mitigations":[],"who_affected":"Windows 10, Windows 11 and Windows Server 2016 to 2025 below the November 2026 builds are listed as affected by Microsoft's record. An attacker needs a local low-privilege account and a hard-to-win condition (AC:H), so it matters most on shared servers, terminal servers and build hosts where untrusted users can log in. Single-user machines with no untrusted local code are lower risk. Not stated whether MSDTC must be running.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["windows"],"ptokens":["windows"],"labels":["high","infrastructure","local","msdtc","privilegeescalation","windows"],"campaign_type":null,"search_a":"'-119919':16A,19A '-2026':15A,18A 'coordin':4A 'cve':14A,17A 'distribut':2A 'gain':11A 'heap':5A 'higher':12A 'let':7A 'local':9A 'overflow':6A 'privileg':13A 'transact':3A 'user':10A 'window':1A 'windows':20A","search_b":"'7.0':58B 'access':47B 'attack':44B 'author':43B 'base':31B 'buffer':32B 'coordin':39B 'cvss':55B 'describ':60B 'distribut':37B 'escal':26B 'give':53B 'heap':30B 'heap-bas':29B 'infrastructur':21B 'let':41B 'local':22B,46B 'msdtc':23B 'overflow':33B 'privileg':25B,50B 'privilege-escal':24B 'rais':48B 'remot':62B 'score':56B 'servic':40B 'sourc':52B 'transact':38B 'trigger':63B 'window':27B,36B","search_c":"'allow':74C 'attack':77C 'author':76C 'base':66C 'buffer':67C 'coordin':73C 'distribut':71C 'elev':79C 'heap':65C 'heap-bas':64C 'local':81C 'overflow':68C 'privileg':80C 'transact':72C 'window':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119919","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119919","severity":null,"published_at":"2026-11-10T19:20:13+00:00","modified_at":"2026-11-10T19:20:13+00:00","first_seen_at":"2026-11-10T19:25:03+00:00","fetched_at":"2026-11-10T19:25:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119919:2966","url":"https://app.opencve.io/cve/CVE-2026-119919","severity":null,"published_at":"2026-11-10T22:22:08+00:00","modified_at":"2026-11-10T22:22:08+00:00","first_seen_at":"2026-11-10T22:22:08+00:00","fetched_at":"2026-11-10T22:22:08+00:00","note":"MSRC page is JS-only and unreadable; version ranges taken from Microsoft CNA record via OpenCVE mirror (not primary), so nothing marked verified. No exploitation or PoC seen. Local, AC:H, PR:L.","cites":["https://app.opencve.io/cve/CVE-2026-119919"]}],"documents":[{"id":119461,"url":"https://app.opencve.io/cve/CVE-2026-119919","title":"OpenCVE: CVE-2026-119919 (mirrors Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}