{"id":"CVE-2026-119935","kind":"vulnerability","aliases":["CVE-2026-119935"],"related":[],"title":"Windows Kernel: integer underflow lets an attacker with physical access gain privileges","description":"Integer underflow (wrap or wraparound) in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.","summary":"An integer underflow in the Windows kernel lets an unauthorized attacker raise their privileges when they have physical access to the machine. The sources give a CVSS score of 6.8 and do not describe a remote path.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","kernel","windows"],"not_affected_if":["locked-hardware","no-physical-access"],"how_to_check":"- Check the Windows build with `winver` and compare it to the fixed build in Microsoft's advisory for CVE-2026-119935 (unknown from the sources)","fix":null,"status":"open","published_at":"2026-11-10T19:20:15+00:00","first_seen_at":"2026-11-10T19:25:03+00:00","triaged_at":"2026-11-10T19:55:36+00:00","updated_at":"2026-11-10T19:55:36+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:55:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Kernel: integer underflow lets an attacker with physical access gain privileges","impact":"high","summary":"An integer underflow in the Windows kernel lets an unauthorized attacker raise their privileges when they have physical access to the machine. The sources give a CVSS score of 6.8 and do not describe a remote path.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","kernel","endpoints"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker with physical access gains elevated system privileges","analyst_note":"Find the Microsoft Security Response Center entry for CVE-2026-119935 to confirm affected Windows builds, the fixed build and the exact attack prerequisites.","how_to_check":"- Check the Windows build with `winver` and compare it to the fixed build in Microsoft's advisory for CVE-2026-119935 (unknown from the sources)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-physical-access","locked-hardware"],"who_is_affected":"Windows machines where someone could get physical access, such as shared or unattended workstations, kiosks and laptops that leave the owner's control. Servers in locked data centers and machines with full-disk encryption and strong BIOS passwords are less exposed. The sources do not name affected Windows versions.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4509,"output_tokens":533,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119935':15A,18A '-2026':14A,17A '6.8':52B 'access':10A,41B 'allow':68C 'attack':7A,33B,71C,78C 'cve':13A,16A 'cvss':49B 'describ':56B 'elev':73C 'endpoint':19B 'gain':11A 'give':47B 'infrastructur':20B 'integ':3A,24B,60C 'kernel':2A,21B,29B,67C 'let':5A,30B 'machin':44B 'path':59B 'physic':9A,40B,77C 'privileg':12A,36B,74C 'rais':34B 'remot':58B 'score':50B 'sourc':46B 'unauthor':32B,70C 'underflow':4A,25B,61C 'window':1A,22B,28B,66C 'wrap':62C 'wraparound':64C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where someone could get physical access, such as shared or unattended workstations, kiosks and laptops that leave the owner's control. Servers in locked data centers and machines with full-disk encryption and strong BIOS passwords are less exposed. The sources do not name affected Windows versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["endpoints","infrastructure","kernel","medium","windows"],"campaign_type":null,"search_a":"'-119935':15A,18A '-2026':14A,17A 'access':10A 'attack':7A 'cve':13A,16A 'gain':11A 'integ':3A 'kernel':2A 'let':5A 'physic':9A 'privileg':12A 'underflow':4A 'window':1A","search_b":"'6.8':52B 'access':41B 'attack':33B 'cvss':49B 'describ':56B 'endpoint':19B 'give':47B 'infrastructur':20B 'integ':24B 'kernel':21B,29B 'let':30B 'machin':44B 'path':59B 'physic':40B 'privileg':36B 'rais':34B 'remot':58B 'score':50B 'sourc':46B 'unauthor':32B 'underflow':25B 'window':22B,28B","search_c":"'allow':68C 'attack':71C,78C 'elev':73C 'integ':60C 'kernel':67C 'physic':77C 'privileg':74C 'unauthor':70C 'underflow':61C 'window':66C 'wrap':62C 'wraparound':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119935","severity":null,"published_at":"2026-11-10T19:20:15+00:00","modified_at":"2026-11-10T19:20:15+00:00","first_seen_at":"2026-11-10T19:25:03+00:00","fetched_at":"2026-11-10T19:25:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}