---
id: "CVE-2026-119944"
page: "https://infrastack.ai/live/CVE-2026-119944"
kind: "vulnerability"
aliases: ["CVE-2026-119944"]
title: "Windows: heap overflow in Mobile Device Management lets attackers gain higher privileges"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "windows-10-1607-server-2016", "fixed": ["10.0.14393.9688"], "affected": "< 10.0.14393.9688", "ecosystem": "vendor"}, {"name": "windows-10-1809-server-2019", "fixed": ["10.0.17763.9487"], "affected": "< 10.0.17763.9487", "ecosystem": "vendor"}, {"name": "windows-10-21h2", "fixed": ["10.0.19044.7846"], "affected": "< 10.0.19044.7846", "ecosystem": "vendor"}, {"name": "windows-10-22h2", "fixed": ["10.0.19045.7846"], "affected": "< 10.0.19045.7846", "ecosystem": "vendor"}, {"name": "windows-11-23h2", "fixed": ["10.0.22631.7711"], "affected": "< 10.0.22631.7711", "ecosystem": "vendor"}, {"name": "windows-11-24h2", "fixed": ["10.0.26100.9974"], "affected": "< 10.0.26100.9974", "ecosystem": "vendor"}, {"name": "windows-11-25h2", "fixed": ["10.0.26200.9974"], "affected": "< 10.0.26200.9974", "ecosystem": "vendor"}, {"name": "windows-11-26h1", "fixed": ["10.0.28000.3501"], "affected": "< 10.0.28000.3501", "ecosystem": "vendor"}, {"name": "windows-11-26h2", "fixed": ["10.0.26300.9974"], "affected": "< 10.0.26300.9974", "ecosystem": "vendor"}, {"name": "windows-server-2022", "fixed": ["10.0.20348.5870"], "affected": "< 10.0.20348.5870", "ecosystem": "vendor"}, {"name": "windows-server-2025", "fixed": ["10.0.26100.33822"], "affected": "< 10.0.26100.33822", "ecosystem": "vendor"}]
ecosystems: []
tags: ["enterprise", "infrastructure", "mobile-device-management", "windows", "windows-server"]
not_affected_if: []
published_at: "2026-11-10T19:20:17+00:00"
first_seen_at: "2026-11-10T19:25:04+00:00"
updated_at: "2026-11-10T22:17:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119944", "first_seen_at": "2026-11-10T19:25:04+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-119944", "first_seen_at": "2026-11-10T22:17:48+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-119944"]}]
exploit_sources: []
---

# Windows: heap overflow in Mobile Device Management lets attackers gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-119944 (this .md is for agents)

A heap-based buffer overflow in the Windows Mobile Device Management component lets an unauthorized attacker elevate privileges over the network. The sources give a CVSS score of 7.5 and do not describe any exploitation in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:windows-10-1607-server-2016 affected < 10.0.14393.9688 fixed 10.0.14393.9688
- vendor:windows-10-1809-server-2019 affected < 10.0.17763.9487 fixed 10.0.17763.9487
- vendor:windows-10-21h2 affected < 10.0.19044.7846 fixed 10.0.19044.7846
- vendor:windows-10-22h2 affected < 10.0.19045.7846 fixed 10.0.19045.7846
- vendor:windows-11-23h2 affected < 10.0.22631.7711 fixed 10.0.22631.7711
- vendor:windows-11-24h2 affected < 10.0.26100.9974 fixed 10.0.26100.9974
- vendor:windows-11-25h2 affected < 10.0.26200.9974 fixed 10.0.26200.9974
- vendor:windows-11-26h1 affected < 10.0.28000.3501 fixed 10.0.28000.3501
- vendor:windows-11-26h2 affected < 10.0.26300.9974 fixed 10.0.26300.9974
- vendor:windows-server-2022 affected < 10.0.20348.5870 fixed 10.0.20348.5870
- vendor:windows-server-2025 affected < 10.0.26100.33822 fixed 10.0.26100.33822

## How to check

Run winver or [Environment]::OSVersion in PowerShell and compare the full build number (e.g. 10.0.26100.xxxx) against the fixed build for your Windows version. Anything below it is affected. Exposure is also tied to the MDM component; enrollment requirements are unconfirmed.

## Fix

Install the November 2026 Windows cumulative update (builds per product: Win10 1607/Server 2016 10.0.14393.9688, 1809/Server 2019 10.0.17763.9487, 21H2 10.0.19044.7846, 22H2 10.0.19045.7846, Win11 23H2 10.0.22631.7711, 24H2 10.0.26100.9974, 25H2 10.0.26200.9974, 26H1 10.0.28000.3501, 26H2 10.0.26300.9974, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822). Fixed builds come from a mirror of the CVE record, not read on the MSRC page.

## Timeline

- 2026-11-10T19:25:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119944
- 2026-11-10T22:17:48+00:00 analyst https://app.opencve.io/cve/CVE-2026-119944 — MSRC update guide page is JS-only and returned nothing; builds taken from Microsoft's CNA record as mirrored by OpenCVE (secondary). Nothing verified. Enrollment requirements not stated anywhere I could read; MSRC page needs a manual look. Vector AV:N/AC:H/UI:R, E:U (exploit unproven), no KEV.

## Documents

- [describes] OpenCVE: CVE-2026-119944 (mirrors Microsoft CNA record) https://app.opencve.io/cve/CVE-2026-119944

## From the sources

Heap-based buffer overflow in Windows Mobile Device Management allows an unauthorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_