{"id":"CVE-2026-119943","kind":"vulnerability","aliases":["CVE-2026-119943"],"related":[],"title":"Windows 11 and Server 2025: Windows Search buffer over-read lets a local user gain higher privileges","description":"Buffer over-read in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.","summary":"A buffer over-read in the Windows Search component lets an authorized local user raise their privileges on the machine. The sources give no further detail on the exploit path.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":">= 10.0.26100.0, < 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":">= 10.0.26200.0, < 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":">= 10.0.28000.0, < 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":">= 10.0.26300.0, < 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows","windows-11","windows-search","windows-server-2025"],"not_affected_if":["no-local-accounts","patched-build"],"how_to_check":"Run winver or [System.Environment]::OSVersion.Version in PowerShell and compare the build with the fixed builds: Windows 11 24H2 < 10.0.26100.9974, 25H2 < 10.0.26200.9974, 26H1 < 10.0.28000.3501, 26H2 < 10.0.26300.9974, Windows Server 2025 < 10.0.26100.33822. Also check: sc query WSearch (service present). KB numbers: see the MSRC page for this CVE.","fix":"Install the November 2026 Windows cumulative update that brings the build to: Windows 11 24H2 10.0.26100.9974, 25H2 10.0.26200.9974, 26H1 10.0.28000.3501, 26H2 10.0.26300.9974, Windows Server 2025 10.0.26100.33822 or later. KB numbers not confirmed.","status":"open","published_at":"2026-11-10T19:20:17+00:00","first_seen_at":"2026-11-10T19:25:04+00:00","triaged_at":"2026-11-10T19:40:10+00:00","updated_at":"2026-11-10T22:17:58+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:40:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Search: buffer over-read lets a local user gain higher privileges","impact":"high","summary":"A buffer over-read in the Windows Search component lets an authorized local user raise their privileges on the machine. The sources give no further detail on the exploit path.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-search"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows machine","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-119943 to confirm affected builds, fixed KB numbers and the exploit preconditions.","how_to_check":"- Check the Windows build with `winver` and compare it against Microsoft's security update guide for CVE-2026-119943\n- Confirm whether Windows Search (`SearchIndexer.exe`) is running with `sc query WSearch`","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-accounts"],"who_is_affected":"Only machines running Windows with the Windows Search component present, where a user already has a local account. The sources do not say which Windows builds are affected or whether the default configuration is exposed. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":4492,"output_tokens":487,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-119943 to confirm affected builds, fixed KB numbers and the exploit preconditions.","search":"'-11':47B '-119943':21A,24A '-2026':20A,23A '11':2A,26A,29A,32A,35A '2025':5A,39A,54B '24h2':27A '25h2':30A '26h1':33A '26h2':36A 'allow':95C 'attack':98C 'author':67B,97C 'buffer':8A,56B,86C 'compon':64B,94C 'cve':19A,22A 'detail':81B 'elev':100C 'escal':44B 'exploit':84B 'gain':16A 'give':78B 'higher':17A 'infrastructur':40B 'let':12A,65B 'local':14A,42B,68B,102C 'local-privilege-escal':41B 'machin':75B 'microsoft':91C 'over-read':9A,57B,87C 'path':85B 'privileg':18A,43B,72B,101C 'rais':70B 'read':11A,59B,89C 'search':7A,50B,63B,93C 'server':4A,38A,53B 'sourc':77B 'user':15A,69B 'window':1A,6A,45B,46B,49B,52B,62B,92C 'windows':25A,28A,31A,34A,37A 'windows-search':48B 'windows-serv':51B","nicknames":[],"mitigations":[],"who_affected":"Windows 11 24H2, 25H2, 26H1, 26H2 and Windows Server 2025 (including Server Core) below the fixed builds, where a user already has a local account; the attacker must be authorized locally, no user interaction needed. Multi-user machines, shared workstations, RDS/terminal servers and build hosts matter most. Earlier Windows versions are not listed in the CNA record. Single-user machines are lower priority but should still patch.","tier":"B","verified":{"products":{"at":"2026-11-10T22:17:58Z","by":"analyst","doc":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119943.json","run_id":2954}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1124h2","1125h2","1126h1","1126h2","server2025","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2025"],"ptokens":["11","2025","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","windows","windows11","windowssearch","windowsserver2025"],"campaign_type":null,"search_a":"'-119943':21A,24A '-2026':20A,23A '11':2A,26A,29A,32A,35A '2025':5A,39A '24h2':27A '25h2':30A '26h1':33A '26h2':36A 'buffer':8A 'cve':19A,22A 'gain':16A 'higher':17A 'let':12A 'local':14A 'over-read':9A 'privileg':18A 'read':11A 'search':7A 'server':4A,38A 'user':15A 'window':1A,6A 'windows':25A,28A,31A,34A,37A","search_b":"'-11':47B '2025':54B 'author':67B 'buffer':56B 'compon':64B 'detail':81B 'escal':44B 'exploit':84B 'give':78B 'infrastructur':40B 'let':65B 'local':42B,68B 'local-privilege-escal':41B 'machin':75B 'over-read':57B 'path':85B 'privileg':43B,72B 'rais':70B 'read':59B 'search':50B,63B 'server':53B 'sourc':77B 'user':69B 'window':45B,46B,49B,52B,62B 'windows-search':48B 'windows-serv':51B","search_c":"'allow':95C 'attack':98C 'author':97C 'buffer':86C 'compon':94C 'elev':100C 'local':102C 'microsoft':91C 'over-read':87C 'privileg':101C 'read':89C 'search':93C 'window':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119943","severity":null,"published_at":"2026-11-10T19:20:17+00:00","modified_at":"2026-11-10T19:20:17+00:00","first_seen_at":"2026-11-10T19:25:04+00:00","fetched_at":"2026-11-10T19:25:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119943:2954","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119943.json","severity":null,"published_at":"2026-11-10T22:17:58+00:00","modified_at":"2026-11-10T22:17:58+00:00","first_seen_at":"2026-11-10T22:17:58+00:00","fetched_at":"2026-11-10T22:17:58+00:00","note":"MSRC page is JS-only and unreadable; used Microsoft's own CNA record in the CVE list (affected builds, fixed build numbers, CWE-126, CVSS 7.8, CISA SSVC exploitation none). KB numbers not found.","cites":["https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119943.json"]}],"documents":[{"id":119448,"url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119943.json","title":"CVE record CVE-2026-119943 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}