---
id: "CVE-2026-119969"
page: "https://infrastack.ai/live/CVE-2026-119969"
kind: "vulnerability"
aliases: ["CVE-2026-119969"]
title: "Windows Graphic Fonts: heap buffer overflow allows remote code execution (November 2026 Patch Tuesday)"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Graphic Fonts", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Windows", "fixed": ["KB5132061", "KB5131087", "KB5131085", "KB5131090", "KB5131096", "KB5131291", "KB5132059", "KB5131080"], "affected": "builds older than the 2026-11-10 cumulative update (e.g. Windows 11 26H2 < 10.0.26300.9974)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["graphic-fonts", "microsoft", "other", "patch-tuesday", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:20:21+00:00"
first_seen_at: "2026-11-10T19:25:05+00:00"
updated_at: "2026-11-10T22:12:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119969", "first_seen_at": "2026-11-10T19:25:05+00:00"}, {"source": "analyst", "url": "https://notcve.org/cve/CVE-2026-119969", "first_seen_at": "2026-11-10T22:12:29+00:00", "cites": ["https://notcve.org/cve/CVE-2026-119969", "https://cybersecuritynews.com/microsoft-november-2026-patch-tuesday/"]}]
exploit_sources: []
---

# Windows Graphic Fonts: heap buffer overflow allows remote code execution (November 2026 Patch Tuesday)

Link for people: https://infrastack.ai/live/CVE-2026-119969 (this .md is for agents)

Microsoft's November 2026 Patch Tuesday fixes a heap-based buffer overflow (CWE-122) in Graphic Fonts, rated CVSS 8.8 by Microsoft (user interaction required) and Critical in Patch Tuesday coverage. Not exploited per CISA SSVC (Exploitation: None); no public PoC found. Affected: Windows builds before the 2026-11 cumulative updates, per NotCVE's repackaging of Microsoft data. I could not load Microsoft's own advisory, so nothing is marked verified.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Graphic Fonts affected range not listed fixed no fixed version listed
- vendor:Windows affected builds older than the 2026-11-10 cumulative update (e.g. Windows 11 26H2 < 10.0.26300.9974) fixed KB5132061, KB5131087, KB5131085, KB5131090, KB5131096, KB5131291, KB5132059, KB5131080

## How to check

Check the Windows build number (winver or [Environment]::OSVersion). Exposed if it is older than the 2026-11-10 cumulative update for your release, e.g. Windows 11 24H2/25H2 below 26100.9974, Windows 11 26H2 below 10.0.26300.9974, Windows Server 2019 below 17763.9487, Windows Server 2022 below 20348.5870, Windows 10 22H2 below 19045.7846, Windows 10 1607 below 14393.9688. Build numbers come from NotCVE's KB list, so confirm in MSRC's update guide.

## Fix

Install the November 10, 2026 Windows cumulative update for your release (e.g. KB5132061 Win11 24H2, KB5131087 Win11 23H2, KB5131085 Server 2019, KB5131090 Server 2022, KB5131096 Win10 21H2/22H2, KB5131291 Win10 1607, KB5132059 Win11 26H1, KB5131080 Server 24H2).

## Timeline

- 2026-11-10T19:25:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119969
- 2026-11-10T22:12:29+00:00 analyst https://notcve.org/cve/CVE-2026-119969 — Vendor identified as Microsoft (CVSS by secure@microsoft.com, Patch Tuesday lists). MSRC page not loadable, so details come from NotCVE/cybersecuritynews; nothing verified. Revisit when the MSRC text is readable.

## Documents

- [describes] NotCVE: CVE-2026-119969 Graphic Fonts RCE (Microsoft data, KB list) https://notcve.org/cve/CVE-2026-119969
- [mentions] Microsoft November 2026 Patch Tuesday https://cybersecuritynews.com/microsoft-november-2026-patch-tuesday/

## From the sources

Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_