{"id":"CVE-2026-119925","kind":"vulnerability","aliases":["CVE-2026-119925"],"related":[],"title":"Windows Text Services Framework: out-of-bounds read lets local users gain privileges","description":"Out-of-bounds read in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.","summary":"Windows Text Services Framework reads memory past the end of a buffer when handling input. An authorized local user can use this to raise their privileges on the machine.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","local-users","windows"],"not_affected_if":["no-local-users"],"how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update for CVE-2026-119925\n- Confirm the machine is receiving Windows cumulative updates through Windows Update\n- Source does not name affected builds: unknown","fix":null,"status":"open","published_at":"2026-11-10T19:20:14+00:00","first_seen_at":"2026-11-10T19:25:03+00:00","triaged_at":"2026-11-10T19:28:03+00:00","updated_at":"2026-11-10T19:28:03+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:28:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Text Services Framework: out-of-bounds read lets local users gain privileges","impact":"high","summary":"Windows Text Services Framework reads memory past the end of a buffer when handling input. An authorized local user can use this to raise their privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","endpoints","local-users"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher system privileges on the machine","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-119925 to confirm affected Windows builds and the patch KB.","how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update for CVE-2026-119925\n- Confirm the machine is receiving Windows cumulative updates through Windows Update\n- Source does not name affected builds: unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Any Windows machine with the Text Services Framework component that has a local, authorized user account is in scope, since the attacker must already be able to log on. The sources do not name affected Windows builds or whether any non-default configuration is needed. Servers with only administrative, locked-down accounts carry less practical risk, but the flaw still needs patching.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":4492,"output_tokens":532,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-119925 to confirm affected Windows builds and the patch KB.","search":"'-119925':17A,20A '-2026':16A,19A 'allow':66C 'attack':69C 'author':43B,68C 'bound':8A,59C 'buffer':38B 'cve':15A,18A 'elev':71C 'end':35B 'endpoint':21B 'framework':4A,30B,65C 'gain':13A 'handl':40B 'infrastructur':22B 'input':41B 'let':10A 'local':11A,24B,44B,73C 'local-us':23B 'machin':55B 'memori':32B 'out-of-bound':5A,56C 'past':33B 'privileg':14A,52B,72C 'rais':50B 'read':9A,31B,60C 'servic':3A,29B,64C 'text':2A,28B,63C 'use':47B 'user':12A,25B,45B 'window':1A,26B,27B,62C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine with the Text Services Framework component that has a local, authorized user account is in scope, since the attacker must already be able to log on. The sources do not name affected Windows builds or whether any non-default configuration is needed. Servers with only administrative, locked-down accounts carry less practical risk, but the flaw still needs patching.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["endpoints","high","infrastructure","localusers","windows"],"campaign_type":null,"search_a":"'-119925':17A,20A '-2026':16A,19A 'bound':8A 'cve':15A,18A 'framework':4A 'gain':13A 'let':10A 'local':11A 'out-of-bound':5A 'privileg':14A 'read':9A 'servic':3A 'text':2A 'user':12A 'window':1A","search_b":"'author':43B 'buffer':38B 'end':35B 'endpoint':21B 'framework':30B 'handl':40B 'infrastructur':22B 'input':41B 'local':24B,44B 'local-us':23B 'machin':55B 'memori':32B 'past':33B 'privileg':52B 'rais':50B 'read':31B 'servic':29B 'text':28B 'use':47B 'user':25B,45B 'window':26B,27B","search_c":"'allow':66C 'attack':69C 'author':68C 'bound':59C 'elev':71C 'framework':65C 'local':73C 'out-of-bound':56C 'privileg':72C 'read':60C 'servic':64C 'text':63C 'window':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119925","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119925","severity":null,"published_at":"2026-11-10T19:20:14+00:00","modified_at":"2026-11-10T19:20:14+00:00","first_seen_at":"2026-11-10T19:25:03+00:00","fetched_at":"2026-11-10T19:25:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}