{"id":"CVE-2026-119966","kind":"vulnerability","aliases":["CVE-2026-119966"],"related":[],"title":"Windows Graphics Kernel: integer overflow lets a local user gain higher privileges","description":"Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"An integer overflow in the Windows Graphics Kernel lets an attacker who already has a local account with high privileges elevate privileges (CWE-190). Microsoft released the fix in the November 2026 updates, rates it Critical (CVSS 3.1 7.5, attack complexity high), and says it is not publicly disclosed and not exploited (Exploitation Less Likely). The affected Windows builds and KB numbers were not available in the sources read.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local","privilege-escalation","windows","windows-kernel"],"not_affected_if":["single-user-machines"],"how_to_check":"Run winver (or PowerShell: Get-ComputerInfo OS*) to get the Windows version and build, then look up CVE-2026-119966 in the Microsoft Security Update Guide (msrc.microsoft.com/update-guide) for the KB and fixed build for your edition. Confirm the November 2026 cumulative update is installed with Get-HotFix. Exact builds: unknown, not read from the page.","fix":null,"status":"open","published_at":"2026-11-10T19:20:21+00:00","first_seen_at":"2026-11-10T19:25:05+00:00","triaged_at":"2026-11-10T19:44:27+00:00","updated_at":"2026-11-10T22:12:21+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:44:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Graphics Kernel: integer overflow lets a local user gain higher privileges","impact":"high","summary":"An integer overflow in the Windows Graphics Kernel lets an attacker who already has a local account raise their privileges. The sources do not describe the exact trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level control of the Windows machine","analyst_note":"Find the Microsoft Security Response Center entry for CVE-2026-119966 to get affected builds and the patch KB.","how_to_check":"- Check the installed Windows build with `winver` and compare it with the patch list in the Microsoft advisory for CVE-2026-119966.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-user-machines"],"who_is_affected":"Windows machines where an authorized local user can run code, including shared workstations, terminal servers and multi-user hosts. Machines with only trusted single users are less exposed. The sources do not list affected Windows builds.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4498,"output_tokens":457,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Response Center entry for CVE-2026-119966 to get affected builds and the patch KB.","search":"'-119966':15A,18A '-190':51B '-2026':14A,17A '2026':59B '3.1':65B '7.5':66B 'account':44B 'affect':84B 'allow':105C 'alreadi':40B 'attack':38B,67B,108C 'author':107C 'avail':92B 'build':86B 'complex':68B 'critic':63B 'cve':13A,16A 'cvss':64B 'cwe':50B 'disclos':76B 'elev':48B,110C 'escal':23B 'exploit':79B,80B 'fix':55B 'gain':10A 'graphic':2A,34B,103C 'high':46B,69B 'higher':11A 'infrastructur':19B 'integ':4A,29B,97C 'kb':88B 'kernel':3A,27B,35B,104C 'less':81B 'let':6A,36B 'like':82B 'local':8A,20B,43B,112C 'microsoft':52B 'novemb':58B 'number':89B 'overflow':5A,30B,98C 'privileg':12A,22B,47B,49B,111C 'privilege-escal':21B 'public':75B 'rate':61B 'read':96B 'releas':53B 'say':71B 'sourc':95B 'updat':60B 'user':9A 'window':1A,24B,26B,33B,85B,102C 'windows-kernel':25B 'wraparound':100C","nicknames":[],"mitigations":[],"who_affected":"Windows systems that have not installed the November 2026 security updates, where an attacker can already run code locally. It matters most on shared machines, terminal servers, VDI and developer or CI hosts where several users or untrusted code run. Single-user machines with no untrusted local code carry lower risk, but should still patch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","local","privilegeescalation","windows","windowskernel"],"campaign_type":null,"search_a":"'-119966':15A,18A '-2026':14A,17A 'cve':13A,16A 'gain':10A 'graphic':2A 'higher':11A 'integ':4A 'kernel':3A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'user':9A 'window':1A","search_b":"'-190':51B '2026':59B '3.1':65B '7.5':66B 'account':44B 'affect':84B 'alreadi':40B 'attack':38B,67B 'avail':92B 'build':86B 'complex':68B 'critic':63B 'cvss':64B 'cwe':50B 'disclos':76B 'elev':48B 'escal':23B 'exploit':79B,80B 'fix':55B 'graphic':34B 'high':46B,69B 'infrastructur':19B 'integ':29B 'kb':88B 'kernel':27B,35B 'less':81B 'let':36B 'like':82B 'local':20B,43B 'microsoft':52B 'novemb':58B 'number':89B 'overflow':30B 'privileg':22B,47B,49B 'privilege-escal':21B 'public':75B 'rate':61B 'read':96B 'releas':53B 'say':71B 'sourc':95B 'updat':60B 'window':24B,26B,33B,85B 'windows-kernel':25B","search_c":"'allow':105C 'attack':108C 'author':107C 'elev':110C 'graphic':103C 'integ':97C 'kernel':104C 'local':112C 'overflow':98C 'privileg':111C 'window':102C 'wraparound':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119966","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119966","severity":null,"published_at":"2026-11-10T19:20:21+00:00","modified_at":"2026-11-10T19:20:21+00:00","first_seen_at":"2026-11-10T19:25:05+00:00","fetched_at":"2026-11-10T19:25:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119966:2938","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-119966","severity":null,"published_at":"2026-11-10T22:12:21+00:00","modified_at":"2026-11-10T22:12:21+00:00","first_seen_at":"2026-11-10T22:12:21+00:00","fetched_at":"2026-11-10T22:12:21+00:00","note":"MSRC SUG API entry read (description, CVSS 7.5, not exploited, not public, Exploitation Less Likely, released 2026-Nov Patch Tuesday). Affected builds and KB numbers not obtainable: the MSRC web page is JS-only, the API response had no product list, CVRF too large to fetch. web-cli search not attempted; X skipped. Nothing verified.","cites":["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-119966"]}],"documents":[{"id":119417,"url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-119966","title":"MSRC Security Update Guide: CVE-2026-119966","kind":"advisory","source":"analyst","publisher":null,"text":"Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. CWE-190. Microsoft severity: Critical. CVSS 3.1 7.5 (temporal 6.5), AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C. Not publicly disclosed, not exploited, Exploitation Less Likely. Released 2026-11-10 (2026-Nov). Customer action required. Page text as retrieved did not list products, builds or KBs.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}