{"id":"CVE-2026-119931","kind":"vulnerability","aliases":["CVE-2026-119931"],"related":[],"title":"Windows Text Services Framework: race condition lets local user gain privileges","description":"Time-of-check time-of-use (toctou) race condition in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.","summary":"A time-of-check time-of-use race condition (CWE-367) in the Windows Text Services Framework lets an authorized local attacker elevate privileges. It needs a local account and a won timing race (CVSS 3.1 7.0, AC:H). Microsoft fixed it in its November 10 2026 updates. No exploitation reported.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","local","privilege-escalation","race-condition","windows"],"not_affected_if":["no-local-users","patched-nov-2026"],"how_to_check":"Run winver, or in PowerShell: [System.Environment]::OSVersion.Version, and compare the full build.revision to the fixed builds. Example: Windows 11 24H2 is vulnerable below 10.0.26100.9974; Server 2022 below 10.0.20348.5870; Server 2025 below 10.0.26100.33822. Per-version table is in the product rows.","fix":"Install the November 2026 cumulative update for your Windows version (builds in the product rows). KB numbers: unknown, take them from the MSRC page for CVE-2026-119931.","status":"open","published_at":"2026-11-10T19:20:14+00:00","first_seen_at":"2026-11-10T19:25:03+00:00","triaged_at":"2026-11-10T19:51:26+00:00","updated_at":"2026-11-10T22:21:00+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:51:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Text Services Framework: race condition lets local user gain privileges","impact":"high","summary":"A time-of-check time-of-use race condition in the Windows Text Services Framework lets an authorized local attacker elevate privileges. The attacker needs an existing local account and must win a timing race inside the component.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user escalates to elevated system privileges on the machine","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds, fixed KB or patch, and any detection or mitigation details.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Windows systems where users have local logon access are the exposed surface, since the attacker must already be authorized on the machine. The sources do not name affected Windows builds or whether a specific feature must be enabled. Machines with no untrusted local users carry lower practical risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000669,"input_tokens":4504,"output_tokens":437,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds, fixed KB or patch, and any detection or mitigation details.","search":"'-119931':14A,17A '-2026':13A,16A '-367':76B '10':19A,24A,29A,32A,111B '11':35A,38A,41A,44A,47A '1607':20A '1809':25A '2016':22A '2019':27A '2022':51A '2025':54A '2026':112B '21h2':30A '22h2':33A '23h2':36A '24h2':39A '25h2':42A '26h1':45A '26h2':48A '3.1':101B '7.0':102B 'ac':103B 'account':94B 'allow':133C 'attack':87B,136C 'author':85B,135C 'check':68B,120C 'condit':6A,62B,74B,127C 'cve':12A,15A 'cvss':100B 'cwe':75B 'elev':88B,138C 'escal':59B 'exploit':115B 'fix':106B 'framework':4A,82B,132C 'gain':10A 'h':104B 'infrastructur':55B 'let':7A,83B 'local':8A,56B,86B,93B,140C 'microsoft':105B 'need':91B 'novemb':110B 'privileg':11A,58B,89B,139C 'privilege-escal':57B 'race':5A,61B,73B,99B,126C 'race-condit':60B 'report':116B 'server':21A,26A,50A,53A 'servic':3A,81B,131C 'text':2A,80B,130C 'time':66B,70B,98B,118C,122C 'time-of-check':65B,117C 'time-of-us':69B,121C 'toctou':125C 'updat':113B 'use':72B,124C 'user':9A 'window':1A,63B,79B,129C 'windows':18A,23A,28A,31A,34A,37A,40A,43A,46A,49A,52A 'won':97B","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10, Windows 11 or Windows Server machine below the fixed build above. An attacker already needs a local low-privilege account, so shared machines, terminal servers, VDI and build hosts matter most. Single-user machines with no untrusted local code are lower priority, but still patch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","local","privilegeescalation","racecondition","windows"],"campaign_type":null,"search_a":"'-119931':14A,17A '-2026':13A,16A '10':19A,24A,29A,32A '11':35A,38A,41A,44A,47A '1607':20A '1809':25A '2016':22A '2019':27A '2022':51A '2025':54A '21h2':30A '22h2':33A '23h2':36A '24h2':39A '25h2':42A '26h1':45A '26h2':48A 'condit':6A 'cve':12A,15A 'framework':4A 'gain':10A 'let':7A 'local':8A 'privileg':11A 'race':5A 'server':21A,26A,50A,53A 'servic':3A 'text':2A 'user':9A 'window':1A 'windows':18A,23A,28A,31A,34A,37A,40A,43A,46A,49A,52A","search_b":"'-367':76B '10':111B '2026':112B '3.1':101B '7.0':102B 'ac':103B 'account':94B 'attack':87B 'author':85B 'check':68B 'condit':62B,74B 'cvss':100B 'cwe':75B 'elev':88B 'escal':59B 'exploit':115B 'fix':106B 'framework':82B 'h':104B 'infrastructur':55B 'let':83B 'local':56B,86B,93B 'microsoft':105B 'need':91B 'novemb':110B 'privileg':58B,89B 'privilege-escal':57B 'race':61B,73B,99B 'race-condit':60B 'report':116B 'servic':81B 'text':80B 'time':66B,70B,98B 'time-of-check':65B 'time-of-us':69B 'updat':113B 'use':72B 'window':63B,79B 'won':97B","search_c":"'allow':133C 'attack':136C 'author':135C 'check':120C 'condit':127C 'elev':138C 'framework':132C 'local':140C 'privileg':139C 'race':126C 'servic':131C 'text':130C 'time':118C,122C 'time-of-check':117C 'time-of-us':121C 'toctou':125C 'use':124C 'window':129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119931","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119931","severity":null,"published_at":"2026-11-10T19:20:14+00:00","modified_at":"2026-11-10T19:20:15+00:00","first_seen_at":"2026-11-10T19:25:03+00:00","fetched_at":"2026-11-10T19:25:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119931:2961","url":"https://app.opencve.io/cve/CVE-2026-119931","severity":null,"published_at":"2026-11-10T22:21:00+00:00","modified_at":"2026-11-10T22:21:00+00:00","first_seen_at":"2026-11-10T22:21:00+00:00","fetched_at":"2026-11-10T22:21:00+00:00","note":"Patched in Microsoft's Nov 10 2026 updates. Build numbers come from the CNA record as mirrored by OpenCVE. The MSRC page is JS-only and I could not read it, so nothing is marked verified and the KB numbers are unknown. No exploitation or PoC found; KEV false. Local EoP, CVSS 7.0, AC:H.","cites":["https://app.opencve.io/cve/CVE-2026-119931","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119931"]}],"documents":[{"id":119456,"url":"https://app.opencve.io/cve/CVE-2026-119931","title":"OpenCVE: CVE-2026-119931 (mirrors Microsoft CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":119457,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119931","title":"MSRC: Windows Text Services Framework Elevation of Privilege Vulnerability (not readable by tool; JS page)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}