{"id":"CVE-2026-119933","kind":"vulnerability","aliases":["CVE-2026-119933"],"related":[],"title":"Windows NTFS: uninitialized resource lets local user gain higher privileges","description":"Use of uninitialized resource in Windows NTFS allows an authorized attacker to elevate privileges locally.","summary":"A flaw in how Windows NTFS handles an uninitialized resource lets a user who already has a local account elevate their privileges. An attacker who can log on to the machine could gain administrator-level control.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","multi-user-systems","ntfs","windows"],"not_affected_if":["no-local-accounts"],"how_to_check":"- Check the installed Windows build with `winver` and compare it against the fixed build in Microsoft's advisory, which the sources do not state.\n- Confirm the machine is patched in Windows Update history.","fix":null,"status":"open","published_at":"2026-11-10T19:20:15+00:00","first_seen_at":"2026-11-10T19:25:03+00:00","triaged_at":"2026-11-10T19:40:14+00:00","updated_at":"2026-11-10T19:40:14+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:40:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows NTFS: uninitialized resource lets local user gain higher privileges","impact":"high","summary":"A flaw in how Windows NTFS handles an uninitialized resource lets a user who already has a local account elevate their privileges. An attacker who can log on to the machine could gain administrator-level control.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","ntfs","multi-user-systems"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Confirm affected Windows builds and the Microsoft fixed build from the NVD entry or Microsoft Security Response Center advisory.","how_to_check":"- Check the installed Windows build with `winver` and compare it against the fixed build in Microsoft's advisory, which the sources do not state.\n- Confirm the machine is patched in Windows Update history.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-accounts"],"who_is_affected":"Any Windows system where an authorized user can log on locally is potentially exposed, since the attacker must already have an account. Servers and workstations with multiple user accounts are the most relevant; systems with a single trusted user are lower risk. The sources do not state which Windows versions are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4488,"output_tokens":515,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Windows builds and the Microsoft fixed build from the NVD entry or Microsoft Security Response Center advisory.","search":"'-119933':13A,16A '-2026':12A,15A 'account':42B 'administr':58B 'administrator-level':57B 'allow':68C 'alreadi':38B 'attack':47B,71C 'author':70C 'control':60B 'could':55B 'cve':11A,14A 'elev':43B,73C 'flaw':25B 'gain':8A,56B 'handl':30B 'higher':9A 'infrastructur':17B 'let':5A,34B 'level':59B 'local':6A,41B,75C 'log':50B 'machin':54B 'multi':19B 'multi-user-system':18B 'ntfs':2A,22B,29B,67C 'privileg':10A,45B,74C 'resourc':4A,33B,64C 'system':21B 'uniniti':3A,32B,63C 'use':61C 'user':7A,20B,36B 'window':1A,23B,28B,66C","nicknames":[],"mitigations":[],"who_affected":"Any Windows system where an authorized user can log on locally is potentially exposed, since the attacker must already have an account. Servers and workstations with multiple user accounts are the most relevant; systems with a single trusted user are lower risk. The sources do not state which Windows versions are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","multiusersystems","ntfs","windows"],"campaign_type":null,"search_a":"'-119933':13A,16A '-2026':12A,15A 'cve':11A,14A 'gain':8A 'higher':9A 'let':5A 'local':6A 'ntfs':2A 'privileg':10A 'resourc':4A 'uniniti':3A 'user':7A 'window':1A","search_b":"'account':42B 'administr':58B 'administrator-level':57B 'alreadi':38B 'attack':47B 'control':60B 'could':55B 'elev':43B 'flaw':25B 'gain':56B 'handl':30B 'infrastructur':17B 'let':34B 'level':59B 'local':41B 'log':50B 'machin':54B 'multi':19B 'multi-user-system':18B 'ntfs':22B,29B 'privileg':45B 'resourc':33B 'system':21B 'uniniti':32B 'user':20B,36B 'window':23B,28B","search_c":"'allow':68C 'attack':71C 'author':70C 'elev':73C 'local':75C 'ntfs':67C 'privileg':74C 'resourc':64C 'uniniti':63C 'use':61C 'window':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119933","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119933","severity":null,"published_at":"2026-11-10T19:20:15+00:00","modified_at":"2026-11-10T19:20:15+00:00","first_seen_at":"2026-11-10T19:25:03+00:00","fetched_at":"2026-11-10T19:25:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}