---
id: "CVE-2026-119941"
page: "https://infrastack.ai/live/CVE-2026-119941"
kind: "vulnerability"
aliases: ["CVE-2026-119941"]
title: "Windows Volume Shadow Copy: pointer flaw lets local attacker gain higher privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Volume Shadow Copy", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Windows 10 1607", "fixed": ["10.0.14393.9688"], "affected": ">= 10.0.14393.0, < 10.0.14393.9688", "ecosystem": "vendor"}, {"name": "Windows 10 1809", "fixed": ["10.0.17763.9487"], "affected": ">= 10.0.17763.0, < 10.0.17763.9487", "ecosystem": "vendor"}, {"name": "Windows 10 21H2", "fixed": ["10.0.19044.7846"], "affected": ">= 10.0.19044.0, < 10.0.19044.7846", "ecosystem": "vendor"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": ">= 10.0.19045.0, < 10.0.19045.7846", "ecosystem": "vendor"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": ">= 10.0.22631.0, < 10.0.22631.7711", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "local", "privilege-escalation", "windows"]
not_affected_if: ["patched-nov-2026"]
published_at: "2026-11-10T19:20:16+00:00"
first_seen_at: "2026-11-10T19:25:04+00:00"
updated_at: "2026-11-10T22:18:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119941", "first_seen_at": "2026-11-10T19:25:04+00:00"}, {"source": "analyst", "url": "https://radar.offseq.com/threat/cve-2026-119941-cwe-822-untrusted-pointer-dereference-in-microsoft-windows-10-version-1607-5adba2d24ff08e9a", "first_seen_at": "2026-11-10T22:18:54+00:00", "cites": ["https://radar.offseq.com/threat/cve-2026-119941-cwe-822-untrusted-pointer-dereference-in-microsoft-windows-10-version-1607-5adba2d24ff08e9a"]}]
exploit_sources: []
---

# Windows Volume Shadow Copy: pointer flaw lets local attacker gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-119941 (this .md is for agents)

Windows Volume Shadow Copy dereferences an untrusted pointer, which a local user can abuse. An attacker with local access can elevate privileges on the affected machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Volume Shadow Copy affected range not listed fixed no fixed version listed
- vendor:Windows 10 1607 affected >= 10.0.14393.0, < 10.0.14393.9688 fixed 10.0.14393.9688
- vendor:Windows 10 1809 affected >= 10.0.17763.0, < 10.0.17763.9487 fixed 10.0.17763.9487
- vendor:Windows 10 21H2 affected >= 10.0.19044.0, < 10.0.19044.7846 fixed 10.0.19044.7846
- vendor:Windows 10 22H2 affected >= 10.0.19045.0, < 10.0.19045.7846 fixed 10.0.19045.7846
- vendor:Windows 11 23H2 affected >= 10.0.22631.0, < 10.0.22631.7711 fixed 10.0.22631.7711

## How to check

Run winver or [System.Environment]::OSVersion in PowerShell and compare the build number with the fixed builds. A build below the fixed one for your Windows version is exposed. Check the MSRC entry for other versions, including Windows 11 24H2/25H2 and Server.

## Fix

Install the November 2026 Windows cumulative update. Fixed builds per the CVE record: Win10 1607 10.0.14393.9688, 1809 10.0.17763.9487, 21H2 10.0.19044.7846, 22H2 10.0.19045.7846, Win11 23H2 10.0.22631.7711 (OffSeq lists 11 fixed builds in total and shows only these 6). Confirm against the MSRC entry.

## Timeline

- 2026-11-10T19:25:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119941
- 2026-11-10T22:18:54+00:00 analyst https://radar.offseq.com/threat/cve-2026-119941-cwe-822-untrusted-pointer-dereference-in-microsoft-windows-10-version-1607-5adba2d24ff08e9a — MSRC page is JS-only and unreadable here; builds and fixes come from OffSeq's mirror of the CVE record (secondary), so nothing is marked verified. Not in KEV, no PoC found, no exploitation reported. Patched in the Nov 2026 Patch Tuesday.

## Documents

- [describes] OffSeq: CVE-2026-119941 (mirrors CVE record) https://radar.offseq.com/threat/cve-2026-119941-cwe-822-untrusted-pointer-dereference-in-microsoft-windows-10-version-1607-5adba2d24ff08e9a

## From the sources

Untrusted pointer dereference in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_