{"id":"CVE-2026-122172","kind":"vulnerability","aliases":["CVE-2026-122172"],"related":[],"title":"Microsoft Trace Data Helper: use-after-free lets a local user gain higher privileges","description":"Use after free in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.","summary":"Microsoft Trace Data Helper has a use-after-free memory flaw that lets an already-authorized local user elevate their privileges. An attacker who already has a foothold on the machine can gain higher system rights.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 / Server 2016 (1607)","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","local","privilege-escalation","windows","windows-server"],"not_affected_if":["no-local-access","patched"],"how_to_check":"On each Windows host run winver or [Environment]::OSVersion / (Get-ComputerInfo).OsBuildNumber with UBR (reg query 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' /v UBR) and compare the full build to the fixed builds listed in the fix. Lower means exposed.","fix":"Install the November 2026 Windows cumulative update that brings the build to at least: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. KB numbers not confirmed.","status":"open","published_at":"2026-11-10T19:20:34+00:00","first_seen_at":"2026-11-10T19:25:10+00:00","triaged_at":"2026-11-10T19:38:55+00:00","updated_at":"2026-11-10T21:39:56+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Microsoft Trace Data Helper: use-after-free lets a local user gain higher privileges","impact":"high","summary":"Microsoft Trace Data Helper has a use-after-free memory flaw that lets an already-authorized local user elevate their privileges. An attacker who already has a foothold on the machine can gain higher system rights.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains administrator or SYSTEM privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-122172 for affected Windows builds and the fixed update.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-access"],"who_is_affected":"Only users with local access to a Windows machine running the affected Trace Data Helper component can exploit this, since the attacker must already be authorized on the system. The sources do not state which Windows versions or product builds are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":4488,"output_tokens":431,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-122172 for affected Windows builds and the fixed update.","search":"'-122172':18A,21A '-2026':17A,20A '10':23A,28A,33A,36A '11':39A,42A,45A,48A,51A '1607':26A '1809':29A '2016':25A '2019':31A '2022':55A '2025':58A '21h2':34A '22h2':37A '23h2':40A '24h2':43A '25h2':46A '26h1':49A '26h2':52A 'allow':114C 'alreadi':84B,94B 'already-author':83B 'attack':92B,117C 'author':85B,116C 'cve':16A,19A 'data':3A,70B,112C 'elev':88B,119C 'escal':63B 'flaw':79B 'foothold':97B 'free':8A,77B,108C 'gain':13A,102B 'helper':4A,71B,113C 'higher':14A,103B 'infrastructur':59B 'let':9A,81B 'local':11A,60B,86B,121C 'machin':100B 'memori':78B 'microsoft':1A,68B,110C 'privileg':15A,62B,90B,120C 'privilege-escal':61B 'right':105B 'server':24A,30A,54A,57A,67B 'system':104B 'trace':2A,69B,111C 'use':6A,75B,106C 'use-after-fre':5A,74B 'user':12A,87B 'window':64B,66B 'windows':22A,27A,32A,35A,38A,41A,44A,47A,50A,53A,56A 'windows-serv':65B","nicknames":[],"mitigations":[],"who_affected":"Windows 10, Windows 11 and Windows Server 2016/2019/2022/2025 hosts below the fixed builds. An attacker needs an existing low-privilege local account (CVSS AV:L/PR:L), so multi-user machines, shared servers, terminal servers and CI runners matter most. Single-user machines with no untrusted code can patch in the normal cycle.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101809server2019","1021h2","1022h2","10server20161607","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101809server2019","windows1021h2","windows1022h2","windows10server20161607","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","local","privilegeescalation","windows","windowsserver"],"campaign_type":null,"search_a":"'-122172':18A,21A '-2026':17A,20A '10':23A,28A,33A,36A '11':39A,42A,45A,48A,51A '1607':26A '1809':29A '2016':25A '2019':31A '2022':55A '2025':58A '21h2':34A '22h2':37A '23h2':40A '24h2':43A '25h2':46A '26h1':49A '26h2':52A 'cve':16A,19A 'data':3A 'free':8A 'gain':13A 'helper':4A 'higher':14A 'let':9A 'local':11A 'microsoft':1A 'privileg':15A 'server':24A,30A,54A,57A 'trace':2A 'use':6A 'use-after-fre':5A 'user':12A 'windows':22A,27A,32A,35A,38A,41A,44A,47A,50A,53A,56A","search_b":"'alreadi':84B,94B 'already-author':83B 'attack':92B 'author':85B 'data':70B 'elev':88B 'escal':63B 'flaw':79B 'foothold':97B 'free':77B 'gain':102B 'helper':71B 'higher':103B 'infrastructur':59B 'let':81B 'local':60B,86B 'machin':100B 'memori':78B 'microsoft':68B 'privileg':62B,90B 'privilege-escal':61B 'right':105B 'server':67B 'system':104B 'trace':69B 'use':75B 'use-after-fre':74B 'user':87B 'window':64B,66B 'windows-serv':65B","search_c":"'allow':114C 'attack':117C 'author':116C 'data':112C 'elev':119C 'free':108C 'helper':113C 'local':121C 'microsoft':110C 'privileg':120C 'trace':111C 'use':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122172","severity":null,"published_at":"2026-11-10T19:20:34+00:00","modified_at":"2026-11-10T19:20:34+00:00","first_seen_at":"2026-11-10T19:25:10+00:00","fetched_at":"2026-11-10T19:25:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122172:2834","url":"https://app.opencve.io/cve/CVE-2026-122172","severity":null,"published_at":"2026-11-10T21:39:56+00:00","modified_at":"2026-11-10T21:39:56+00:00","first_seen_at":"2026-11-10T21:39:56+00:00","fetched_at":"2026-11-10T21:39:56+00:00","note":"MSRC page not readable via web-cli; builds/fixed versions taken from the Microsoft CNA record as mirrored by OpenCVE (secondary). Nothing marked verified. No exploitation or PoC found (not in KEV). Confirm on MSRC guide.","cites":["https://app.opencve.io/cve/CVE-2026-122172"]}],"documents":[{"id":118974,"url":"https://app.opencve.io/cve/CVE-2026-122172","title":"OpenCVE: CVE-2026-122172 (mirrors Microsoft CVE record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}