Microsoft Windows: Use-after-free in QWAVE service allows local privilege escalation

Summary

Microsoft Windows contains a use-after-free vulnerability in the Quality Windows Audio/Video Experience (QWAVE) service, tracked as CVE-2026-119387. An authorized local user can exploit it to elevate privileges, which can lead to full control of the affected system. Exploitation has high complexity and requires an attacker who already has local access, for example through malware or on a shared terminal server.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7711)
• Windows 11 Version 24H2, 25H2, 26H2 (10.0.26100.0, 10.0.26200.0, 10.0.26300.0 before the fixed builds listed as fixed)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3501)
• Windows Server 2016 incl. Server Core (10.0.14393.0 before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (10.0.17763.0 before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 before 10.0.20348.5870)

Fixed in

• Windows 10 1607 / Server 2016: 10.0.14393.9688
• Windows 10 1809 / Server 2019: 10.0.17763.9487
• Windows 10 21H2: 10.0.19044.7846
• Windows 10 22H2: 10.0.19045.7846 (KB5131096)
• Windows 11 23H2: 10.0.22631.7711 (KB5131087)
• Windows 11 24H2 / 25H2 / 26H2: 10.0.26100.9974 / 10.0.26200.9974 / 10.0.26300.9974
• Windows 11 26H1: 10.0.28000.3501
• Windows Server 2022: 10.0.20348.5870

Note: The CVE record's 22H2 entry is truncated; verify the full list and KB numbers on MSRC.

Workaround

Unknown. Microsoft's CNA record describes no workaround.

Exploitation

• CISA SSVC: exploitation none, not automatable, total technical impact.
• The CVSS vector includes E:U (exploit maturity unproven).
• No known exploitation in the wild and no public proof of concept found at the time of publication.

Our recommendation

• Install the November 2026 security updates on all affected Windows systems and verify the build number after the restart.
• Prioritize multi-user systems such as RDS hosts, shared workstations, and file or print servers.
• Check systems for signs of compromise, since an attacker needs local access.
• Plan an upgrade for unsupported systems, such as Windows 11 24H2 Home/Pro, because they will not receive this fix.
• Confirm the fix path for Windows 10 1607/1809 and Server 2016/2019 on the MSRC page, since no KB number is confirmed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119387 msrc.microsoft.com
• CVE Record CVE-2026-119387 (CVE.org) www.cve.org
• BleepingComputer: Windows 10 KB5131096 Extended Security Update www.bleepingcomputer.com
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Rescana: Microsoft Patch Tuesday November 2026 www.rescana.com
• Biggo: Windows 11 23H2 KB5131087 and support end finance.biggo.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:53.