Microsoft Windows Task Scheduler: Heap-based buffer overflow enables local privilege escalation
Summary
A heap-based buffer overflow in the Windows Task Scheduler component allows an authorized, low-privileged local user to elevate privileges. The CNA scores it as CVSS 3.1 7.0 (High) with high attack complexity, and VulDB lists 8.8. The attacker needs valid local access first, for example through phishing, stolen credentials or another vulnerability.
Affected
- Windows 10 Version 1607, 1809, 21H2 and 22H2
- Windows 11 Version 23H2, 24H2, 25H2 and 26H1 (per CVE.org; 26H2 listed in the record)
- Windows Server 2016, 2019 and 2022 (including Server Core installations)
- Exact per-build fixed versions: see MSRC. Third-party affected lists differ and are unverified.
Fixed in
- Install the November 2026 security update for each affected Windows version.
- Fixed builds per CVE.org include: Windows 10 1607 at 10.0.14393.9688 or later, 1809 at 10.0.17763.9487 or later, 21H2 at 10.0.19044.7846 or later.
- Unknown: KB article numbers and fixed builds for all other versions; check the MSRC page.
Workaround
- Unknown. No vendor workaround was found. Patching is the remedy.
Exploitation
- No evidence of exploitation found at publication; the CNA vector marks exploit maturity as unproven (E:U).
- Not confirmed in the CISA KEV catalog in the sources reviewed; verify on the KEV catalog.
- No public proof-of-concept found.
- Attack complexity is high and local access with low privileges is required.
Our recommendation
- Apply the November 2026 Windows security update on all affected systems, prioritising Remote Desktop and terminal servers, file servers and shared workstations.
- Confirm build numbers against the MSRC page before compliance checks.
- Review local accounts and limit unnecessary local logons on shared systems as general hardening.
- Monitor for unusual scheduled task creation or changes and for privilege escalation indicators.
- Check NVD and KEV status again for updates.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Task Scheduler
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation more likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-112759 msrc.microsoft.com
- CVE.org CVE Record: CVE-2026-112759 www.cve.org
- VulDB entry 434868 vuldb.com
- Strix.ai: CVE-2026-112759 (third-party, unverified) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:26.
Original description (NVD)
Heap-based buffer overflow in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.