{"id":"CVE-2026-121681","kind":"vulnerability","aliases":["CVE-2026-121681"],"related":[],"title":"Microsoft Trace Data Helper: heap overflow lets a local user gain privileges","description":"Heap-based buffer overflow in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.","summary":"Microsoft's November 2026 update lists a heap-based buffer overflow in Microsoft Trace Data Helper. A local user with a low-privilege account can use it to gain higher privileges on the machine. Microsoft rates it Important (CVSS 7.8), says it is not publicly disclosed or exploited, and rates exploitation less likely. The record names no affected builds or KB yet.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","microsoft","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"Unknown which Windows builds are affected: MSRC has not yet listed products or KB articles. Once it does, compare your installed Windows build and latest cumulative update with the KB in the Security Update Guide for CVE-2026-121681 (winver, or Get-HotFix in PowerShell).","fix":null,"status":"open","published_at":"2026-11-10T19:20:32+00:00","first_seen_at":"2026-11-10T19:25:09+00:00","triaged_at":"2026-11-10T19:39:01+00:00","updated_at":"2026-11-10T21:44:57+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:39:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Microsoft Trace Data Helper: heap overflow lets a local user gain privileges","impact":"high","summary":"Microsoft Trace Data Helper has a heap-based buffer overflow. A local user with some access can use it to elevate their privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","microsoft"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains elevated system privileges on the machine","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds and the patched version or KB.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Affects Windows machines running Microsoft Trace Data Helper; the sources do not say which versions or configurations are vulnerable. Exposure requires an attacker who already has an authorized local account. Systems without that component or with no local untrusted users are lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":4502,"output_tokens":424,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds and the patched version or KB.","search":"'-121681':15A,18A '-2026':14A,17A '2026':25B '7.8':63B 'account':47B 'affect':81B 'allow':96C 'attack':99C 'author':98C 'base':31B,88C 'buffer':32B,89C 'build':82B 'cve':13A,16A 'cvss':62B 'data':3A,37B,94C 'disclos':69B 'elev':101C 'exploit':71B,74B 'gain':11A,52B 'heap':5A,30B,87C 'heap-bas':29B,86C 'helper':4A,38B,95C 'higher':53B 'import':61B 'infrastructur':19B 'kb':84B 'less':75B 'let':7A 'like':76B 'list':27B 'local':9A,40B,103C 'low':45B 'low-privileg':44B 'machin':57B 'microsoft':1A,20B,22B,35B,58B,92C 'name':79B 'novemb':24B 'overflow':6A,33B,90C 'privileg':12A,46B,54B,102C 'public':68B 'rate':59B,73B 'record':78B 'say':64B 'trace':2A,36B,93C 'updat':26B 'use':49B 'user':10A,41B 'window':21B 'yet':85B","nicknames":[],"mitigations":[],"who_affected":"Affects Windows machines running Microsoft Trace Data Helper; the sources do not say which versions or configurations are vulnerable. Exposure requires an attacker who already has an authorized local account. Systems without that component or with no local untrusted users are lower risk.","tier":"B","verified":{"who_affected":{"at":"2026-11-10T21:44:57Z","by":"analyst","doc":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-121681","run_id":2843}},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","microsoft","windows"],"campaign_type":null,"search_a":"'-121681':15A,18A '-2026':14A,17A 'cve':13A,16A 'data':3A 'gain':11A 'heap':5A 'helper':4A 'let':7A 'local':9A 'microsoft':1A 'overflow':6A 'privileg':12A 'trace':2A 'user':10A","search_b":"'2026':25B '7.8':63B 'account':47B 'affect':81B 'base':31B 'buffer':32B 'build':82B 'cvss':62B 'data':37B 'disclos':69B 'exploit':71B,74B 'gain':52B 'heap':30B 'heap-bas':29B 'helper':38B 'higher':53B 'import':61B 'infrastructur':19B 'kb':84B 'less':75B 'like':76B 'list':27B 'local':40B 'low':45B 'low-privileg':44B 'machin':57B 'microsoft':20B,22B,35B,58B 'name':79B 'novemb':24B 'overflow':33B 'privileg':46B,54B 'public':68B 'rate':59B,73B 'record':78B 'say':64B 'trace':36B 'updat':26B 'use':49B 'user':41B 'window':21B 'yet':85B","search_c":"'allow':96C 'attack':99C 'author':98C 'base':88C 'buffer':89C 'data':94C 'elev':101C 'heap':87C 'heap-bas':86C 'helper':95C 'local':103C 'microsoft':92C 'overflow':90C 'privileg':102C 'trace':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121681","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121681","severity":null,"published_at":"2026-11-10T19:20:32+00:00","modified_at":"2026-11-10T19:20:32+00:00","first_seen_at":"2026-11-10T19:25:09+00:00","fetched_at":"2026-11-10T19:25:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121681:2843","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-121681","severity":null,"published_at":"2026-11-10T21:44:57+00:00","modified_at":"2026-11-10T21:44:57+00:00","first_seen_at":"2026-11-10T21:44:57+00:00","fetched_at":"2026-11-10T21:44:57+00:00","note":"MSRC SUG API (2026-Nov): Important, EoP, CWE-122, not publicly disclosed, not exploited, 'Exploitation Less Likely', customer action required. Record lists no products/builds/KB, so fix and affected versions unknown; recheck when MSRC fills the Security Updates table (page is JS-rendered; use the api.msrc.microsoft.com sug endpoint).","cites":["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-121681"]}],"documents":[{"id":119004,"url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-121681","title":"MSRC: Microsoft Trace Data Helper Elevation of Privilege Vulnerability (CVE-2026-121681)","kind":"advisory","source":"analyst","publisher":null,"text":"Microsoft Security Update Guide data, 2026-Nov release. Heap-based buffer overflow (CWE-122) in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally. Severity Important, CVSS 7.8 (temporal 6.8, E:U RL:O). Publicly disclosed: No. Exploited: No. Exploitability: Exploitation Less Likely. Customer action required: yes. The record lists no products, builds or KB articles.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}