{"id":"CVE-2026-119938","kind":"vulnerability","aliases":["CVE-2026-119938"],"related":[],"title":"Windows Shell: heap buffer overflow allows remote code execution (user interaction required)","description":"Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.","summary":"Microsoft's CVE record (Windows Shell Remote Code Execution, CWE-122, CVSS 7.5, AV:N/AC:H/UI:R) says an unauthorized attacker can run code over a network in Windows Shell. The vector needs user interaction. No exploitation or public PoC is recorded. Per-build ranges come from an OpenCVE mirror of the Microsoft record; I could not load the MSRC page itself (JavaScript only).","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Shell","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","rce","user-interaction","windows","windows-server"],"not_affected_if":["patched-nov-2026"],"how_to_check":"Run winver or [System.Environment]::OSVersion / (Get-ComputerInfo).OsBuildNumber and compare the build with the fixed builds in the product rows. Confirm the exact KB on the MSRC page: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119938","fix":"Install the November 2026 Windows security update (builds listed in product rows). Exact KB numbers not read from MSRC.","status":"open","published_at":"2026-11-10T19:20:16+00:00","first_seen_at":"2026-11-10T19:25:03+00:00","triaged_at":"2026-11-10T19:44:31+00:00","updated_at":"2026-11-10T22:18:52+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:44:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Shell: heap buffer overflow lets a network attacker run code","impact":"high","summary":"A heap-based buffer overflow in Windows Shell lets an unauthenticated attacker over the network run code. The sources give no product versions or trigger details.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the affected Windows machine over the network","analyst_note":"Find the affected Windows versions and the Microsoft advisory for CVE-2026-119938 at the NVD link; sources give no fixed build.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Shell","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000631,"input_tokens":4488,"output_tokens":364,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows versions and the Microsoft advisory for CVE-2026-119938 at the NVD link; sources give no fixed build.","search":"'-119938':15A,18A '-122':77B '-2026':14A,17A '10':22A,27A,32A,35A '11':38A,41A,44A,47A,50A '1607':23A '1809':28A '2016':25A '2019':30A '2022':54A '2025':57A '21h2':33A '22h2':36A '23h2':39A '24h2':42A '25h2':45A '26h1':48A '26h2':51A '7.5':79B 'allow':6A,139C 'attack':87B,142C 'av':80B 'base':133C 'buffer':4A,134C 'build':111B 'code':8A,74B,90B,145C 'come':113B 'could':123B 'cve':13A,16A,69B 'cvss':78B 'cwe':76B 'execut':9A,75B,144C 'exploit':103B 'h/ui':82B 'heap':3A,132C 'heap-bas':131C 'infrastructur':58B 'interact':11A,62B,101B 'javascript':130B 'load':125B 'microsoft':67B,120B 'mirror':117B 'msrc':127B 'n/ac':81B 'need':99B 'network':93B,148C 'opencv':116B 'overflow':5A,135C 'page':128B 'per':110B 'per-build':109B 'poc':106B 'public':105B 'r':83B 'rang':112B 'rce':59B 'record':70B,108B,121B 'remot':7A,73B 'requir':12A 'run':89B 'say':84B 'server':24A,29A,53A,56A,66B 'shell':2A,20A,72B,96B,138C 'unauthor':86B,141C 'user':10A,61B,100B 'user-interact':60B 'vector':98B 'window':1A,63B,65B,71B,95B,137C 'windows':19A,21A,26A,31A,34A,37A,40A,43A,46A,49A,52A,55A 'windows-serv':64B","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) or Windows Server (2016, 2019, 2022, 2025) machine below the fixed build listed. The attack needs a user to take an action (UI:R) and is rated high complexity. Fully patched machines can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","shell","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025","windowsshell"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","shell","windows"],"labels":["high","infrastructure","rce","userinteraction","vendor","windows","windowsserver"],"campaign_type":null,"search_a":"'-119938':15A,18A '-2026':14A,17A '10':22A,27A,32A,35A '11':38A,41A,44A,47A,50A '1607':23A '1809':28A '2016':25A '2019':30A '2022':54A '2025':57A '21h2':33A '22h2':36A '23h2':39A '24h2':42A '25h2':45A '26h1':48A '26h2':51A 'allow':6A 'buffer':4A 'code':8A 'cve':13A,16A 'execut':9A 'heap':3A 'interact':11A 'overflow':5A 'remot':7A 'requir':12A 'server':24A,29A,53A,56A 'shell':2A,20A 'user':10A 'window':1A 'windows':19A,21A,26A,31A,34A,37A,40A,43A,46A,49A,52A,55A","search_b":"'-122':77B '7.5':79B 'attack':87B 'av':80B 'build':111B 'code':74B,90B 'come':113B 'could':123B 'cve':69B 'cvss':78B 'cwe':76B 'execut':75B 'exploit':103B 'h/ui':82B 'infrastructur':58B 'interact':62B,101B 'javascript':130B 'load':125B 'microsoft':67B,120B 'mirror':117B 'msrc':127B 'n/ac':81B 'need':99B 'network':93B 'opencv':116B 'page':128B 'per':110B 'per-build':109B 'poc':106B 'public':105B 'r':83B 'rang':112B 'rce':59B 'record':70B,108B,121B 'remot':73B 'run':89B 'say':84B 'server':66B 'shell':72B,96B 'unauthor':86B 'user':61B,100B 'user-interact':60B 'vector':98B 'window':63B,65B,71B,95B 'windows-serv':64B","search_c":"'allow':139C 'attack':142C 'base':133C 'buffer':134C 'code':145C 'execut':144C 'heap':132C 'heap-bas':131C 'network':148C 'overflow':135C 'shell':138C 'unauthor':141C 'window':137C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119938","severity":null,"published_at":"2026-11-10T19:20:16+00:00","modified_at":"2026-11-10T19:20:16+00:00","first_seen_at":"2026-11-10T19:25:03+00:00","fetched_at":"2026-11-10T19:25:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119938:2957","url":"https://app.opencve.io/cve/CVE-2026-119938","severity":null,"published_at":"2026-11-10T22:18:52+00:00","modified_at":"2026-11-10T22:18:52+00:00","first_seen_at":"2026-11-10T22:18:52+00:00","fetched_at":"2026-11-10T22:18:52+00:00","note":"Builds from OpenCVE mirror of the Microsoft CNA record; MSRC page is JS-only and unread, so nothing marked verified. Server 2025 fixed build differs from Win11 24H2 in that source; check on MSRC.","cites":["https://app.opencve.io/cve/CVE-2026-119938"]}],"documents":[{"id":119449,"url":"https://app.opencve.io/cve/CVE-2026-119938","title":"OpenCVE: CVE-2026-119938 (mirror of Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}