Windows Credential Manager: Buffer overflow enables local privilege escalation

Summary

A stack-based buffer overflow in the Windows Credential Manager, the built-in component that stores and manages user credentials, allows an attacker to elevate privileges locally. The attacker needs a valid local account with low privileges, which is typically obtained through phishing, malware or a stolen password. Successful exploitation can give the attacker administrator rights on the affected system, with high impact on confidentiality, integrity and availability. Microsoft has released fixes with the November 2026 Patch Tuesday updates.

Affected

• Windows 10 Version 1607, 1809, 21H2 and 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2
• Windows Server 2016 (including Server Core), 2019 (including Server Core) and 2022
• Windows Server 2025: not listed in the official CVE record; check MSRC.
• Builds below the fixed versions listed below.

Fixed in

• Windows 10 1607: 10.0.14393.9688
• Windows 10 1809: 10.0.17763.9487
• Windows 10 21H2: 10.0.19044.7846
• Windows 10 22H2: 10.0.19045.7846
• Windows 11 23H2: 10.0.22631.7711
• Windows 11 24H2: 10.0.26100.9974
• Windows 11 25H2: 10.0.26200.9974
• Windows 11 26H1: 10.0.28000.3501
• Windows 11 26H2: 10.0.26300.9974
• Windows Server 2016: 10.0.14393.9688
• Windows Server 2019: 10.0.17763.9487
• Windows Server 2022: 10.0.20348.5870

Workaround

Unknown. No official Microsoft workaround was found. Install the security update; until then, apply least-privilege practices to user accounts.

Exploitation

• No evidence of exploitation in the wild in the available sources; check MSRC's 'Exploited' flag.
• No public proof of concept known; exploit maturity is 'Unproven'.
• CISA SSVC: exploitation none, not automatable, total technical impact.

Our recommendation

• Install the November 2026 cumulative updates on all affected Windows 10 and Windows Server systems, starting with shared workstations and terminal servers.
• Confirm the exact fixed build for each operating system on the MSRC advisory before rollout.
• Restrict local logon and limit standard user rights until patching is complete.
• Monitor for unexpected privilege changes and recheck MSRC and NVD for exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-119393 msrc.microsoft.com
• CVE.org record CVE-2026-119393 www.cve.org
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Strix: CVE-2026-119393 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:31.