{"id":"CVE-2026-119957","kind":"vulnerability","aliases":["CVE-2026-119957"],"related":[],"title":"Windows Remote Desktop Services: double free lets a local user gain privileges","description":"Double free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.","summary":"A double free bug in Windows Remote Desktop Services lets an attacker who already has an account on the machine raise their privileges. Successful exploitation gives the attacker higher rights than they were granted.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Server 2016","fixed":["10.0.14393.9688"],"affected":"10.0.14393.0 - < 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows Server 2019","fixed":["10.0.17763.9487"],"affected":"10.0.17763.0 - < 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"10.0.20348.0 - < 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"10.0.26100.0 - < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local-privilege-escalation","remote-desktop-services","title-review","windows","windows-server"],"not_affected_if":["no-local-untrusted-users","rds-not-in-use"],"how_to_check":"Run winver or [Environment]::OSVersion on each Windows Server and compare the full build (including revision) with the fixed builds: 2016 14393.9688, 2019 17763.9487, 2022 20348.5870, 2025 26100.33822. Below that = vulnerable. The CVE record does not say RDS must be enabled; check whether the Remote Desktop Services role or Remote Desktop is on (Get-WindowsFeature RDS*), and treat any host where local users can log in as a priority.","fix":"Install the November 2026 cumulative update: Server 2016 10.0.14393.9688, Server 2019 10.0.17763.9487, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822 (build numbers from the Microsoft CNA record as mirrored by NVD)","status":"open","published_at":"2026-11-10T19:20:19+00:00","first_seen_at":"2026-11-10T19:25:05+00:00","triaged_at":"2026-11-10T19:40:06+00:00","updated_at":"2026-11-10T22:15:37+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:40:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Remote Desktop Services: double free lets a local user gain privileges","impact":"high","summary":"A double free bug in Windows Remote Desktop Services lets an attacker who already has an account on the machine raise their privileges. Successful exploitation gives the attacker higher rights than they were granted.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","remote-desktop-services","windows-server"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the Windows machine","analyst_note":"Confirm the patched Windows builds and whether RDS must be enabled, from the Microsoft MSRC entry for CVE-2026-119957.","how_to_check":"- Check the installed Windows build with `winver` and compare it with the fixed build in Microsoft's advisory for CVE-2026-119957\n- Confirm whether the Remote Desktop Services role is installed or Remote Desktop is enabled on the machine\n- unknown for other checks, the sources do not say","plain_action":"","product_name":"Windows Remote Desktop Services","needs_analyst":true,"not_affected_if":["rds-not-in-use"],"who_is_affected":"Windows machines that run Remote Desktop Services, including Remote Desktop session hosts, are the systems to look at. An attacker must already be authorized on the machine, so the flaw is a local privilege escalation rather than a remote entry point. Machines without Remote Desktop Services in use have less exposure, but the sources do not say that they are unaffected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4484,"output_tokens":612,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the patched Windows builds and whether RDS must be enabled, from the Microsoft MSRC entry for CVE-2026-119957.","search":"'-119957':15A,18A '-2026':14A,17A '2016':21A '2019':24A '2022':27A '2025':30A 'account':63B 'allow':88C 'alreadi':60B 'attack':58B,74B,91C 'author':90C 'bug':50B 'cve':13A,16A 'desktop':3A,38B,54B,86C 'doubl':5A,48B,81C 'elev':93C 'escal':35B 'exploit':71B 'free':6A,49B,82C 'gain':11A 'give':72B 'grant':80B 'higher':75B 'infrastructur':31B 'let':7A,56B 'local':9A,33B,95C 'local-privilege-escal':32B 'machin':66B 'privileg':12A,34B,69B,94C 'rais':67B 'remot':2A,37B,53B,85C 'remote-desktop-servic':36B 'review':42B 'right':76B 'server':20A,23A,26A,29A,46B 'servic':4A,39B,55B,87C 'success':70B 'titl':41B 'title-review':40B 'user':10A 'window':1A,43B,45B,52B,84C 'windows':19A,22A,25A,28A 'windows-serv':44B","nicknames":[],"mitigations":[],"who_affected":"Windows Server 2016, 2019, 2022 and 2025 (including Server Core) below the fixed builds. An attacker needs a local account (CVSS AV:L, PR:L, high complexity), so this matters most on shared hosts, RDS/terminal servers and jump boxes where many users log in. Single-user machines with no untrusted local accounts can patch on the normal cycle. Windows client versions are not listed in the record.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["server2016","server2019","server2022","server2025","windowsserver2016","windowsserver2019","windowsserver2022","windowsserver2025"],"ptokens":["2016","2019","2022","2025","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","remotedesktopservices","titlereview","vendor","windows","windowsserver"],"campaign_type":null,"search_a":"'-119957':15A,18A '-2026':14A,17A '2016':21A '2019':24A '2022':27A '2025':30A 'cve':13A,16A 'desktop':3A 'doubl':5A 'free':6A 'gain':11A 'let':7A 'local':9A 'privileg':12A 'remot':2A 'server':20A,23A,26A,29A 'servic':4A 'user':10A 'window':1A 'windows':19A,22A,25A,28A","search_b":"'account':63B 'alreadi':60B 'attack':58B,74B 'bug':50B 'desktop':38B,54B 'doubl':48B 'escal':35B 'exploit':71B 'free':49B 'give':72B 'grant':80B 'higher':75B 'infrastructur':31B 'let':56B 'local':33B 'local-privilege-escal':32B 'machin':66B 'privileg':34B,69B 'rais':67B 'remot':37B,53B 'remote-desktop-servic':36B 'review':42B 'right':76B 'server':46B 'servic':39B,55B 'success':70B 'titl':41B 'title-review':40B 'window':43B,45B,52B 'windows-serv':44B","search_c":"'allow':88C 'attack':91C 'author':90C 'desktop':86C 'doubl':81C 'elev':93C 'free':82C 'local':95C 'privileg':94C 'remot':85C 'servic':87C 'window':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119957","severity":null,"published_at":"2026-11-10T19:20:19+00:00","modified_at":"2026-11-10T19:20:19+00:00","first_seen_at":"2026-11-10T19:25:05+00:00","fetched_at":"2026-11-10T19:25:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119957:2944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119957","severity":null,"published_at":"2026-11-10T22:15:37+00:00","modified_at":"2026-11-10T22:15:37+00:00","first_seen_at":"2026-11-10T22:15:37+00:00","fetched_at":"2026-11-10T22:15:37+00:00","note":"MSRC page is JS-only and unreadable; versions taken from the Microsoft CNA record on NVD. Nothing marked verified. No exploitation or PoC reported; not in KEV. Whether RDS must be enabled is unconfirmed.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-119957"]}],"documents":[{"id":119428,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119957","title":"NVD CVE-2026-119957 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}