Windows: Elevation of privilege in Servicing Stack Updates
Summary
Windows Servicing Stack Updates contain an untrusted pointer dereference (CWE-822). A local attacker with a low-privileged user account can use it to elevate privileges, potentially to SYSTEM. Exploitation requires high attack complexity and is not possible remotely. Microsoft's CVSS vector marks exploit code maturity as Unproven, and CISA SSVC rates the flaw as not automatable.
Affected
- Windows 11 Version 24H2: builds 10.0.26100.0 before 10.0.26100.9974
- Windows 11 Version 25H2: builds 10.0.26200.0 before 10.0.26200.9974
- Windows 11 Version 26H2: builds 10.0.26300.0 before 10.0.26300.9974
- Windows Server 2025 (including Server Core): builds 10.0.26100.0 before 10.0.26100.33822 (per CVE record)
Fixed in
- Windows 11 24H2: 10.0.26100.9974
- Windows 11 25H2: 10.0.26200.9974
- Windows 11 26H2: 10.0.26300.9974
- Windows Server 2025: 10.0.26100.33822 (taken from a third-party aggregator, not yet verified against the MSRC advisory)
- KB numbers: Unknown.
Workaround
Unknown. No workaround is documented; install the November 2026 security updates.
Exploitation
- No public proof of concept or in-the-wild exploitation is known.
- CVSS exploit code maturity is Unproven (E:U).
- Talos does not list this CVE among the exploited flaws of the November 2026 release.
- CISA KEV status was not checked.
Our recommendation
- Install the November 2026 Windows updates on Windows 11 24H2, 25H2 and 26H2 endpoints and on Windows Server 2025 systems.
- Verify that the build number is at or above the fixed build.
- Check the MSRC advisory for the Server 2025 fixed build before relying on the third-party value.
- Install the Servicing Stack Update together with the cumulative update.
- Priority is medium: the flaw requires an existing local user account and is not an entry point, but it is often combined with other attack steps.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-112989 msrc.microsoft.com
- CVE Record CVE-2026-112989 (CVE Program) www.cve.org
- Strix: CVE-2026-112989 (third-party, unverified build for Server 2025) www.strix.ai
- Rapid7: Patch Tuesday November 2026 www.rapid7.com
- Qualys: Microsoft Patch Tuesday November 2026 review blog.qualys.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:07.
Original description (NVD)
Untrusted pointer dereference in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.