Windows Text Services Framework: Elevation of privilege via incorrect authorization

Summary

Incorrect authorization in the Windows Text Services Framework allows an authorized local user to elevate privileges. An attacker needs a low-privileged account and local access, for example after phishing or a stolen password. Successful exploitation could give full control over the affected system (CVSS 3.1 7.8, as recorded in aggregator data; NVD analysis is still pending).

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): 10.0.14393.0 to below 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): 10.0.17763.0 to below 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7711
• Windows 11 Version 24H2, 25H2 and 26H2: affected (see MSRC for exact builds)
• Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3501
• Windows Server 2022: 10.0.20348.0 to below 10.0.20348.5870

Fixed in

Security update of November 10, 2026 (Patch Tuesday). Fixed builds according to the CNA record and an unverified aggregator list: Windows 10 1607/Server 2016 from 10.0.14393.9688; Windows 10 1809/Server 2019 from 10.0.17763.9487; Windows 10 21H2 from 10.0.19044.7846; Windows 10 22H2 from 10.0.19045.7846; Windows 11 23H2 from 10.0.22631.7711; Windows Server 2022 from 10.0.20348.5870. Windows Server 2025, Windows 11 24H2/25H2/26H1 and Windows 10 ESU: Unknown. KB numbers per OS: Unknown (confirm in the MSRC table).

Workaround

Unknown. No vendor or third-party workaround was found. Patching is the remedy.

Exploitation

• Microsoft exploitability index: "Exploitation More Likely" (Tenable)
• CISA SSVC: exploitation none, not automatable, total technical impact
• Talos reports one November 2026 Microsoft vulnerability as exploited in the wild, but the sources do not name it; it is unconfirmed whether this CVE is that one
• No public proof of concept known

Our recommendation

• Install the November 2026 security update on all affected systems, prioritising multi-user systems such as RDS/terminal servers, shared workstations and file servers
• Check whether older builds (Windows 10 1607/1809, Server 2016/2019) are still supported and receiving updates
• Confirm the exact fixed build and KB per OS in the MSRC Security Update Guide
• Check the MSRC "Exploited" flag and CISA KEV for changes in exploitation status
• Monitor for unusual local privilege escalation on hosts with many users

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (MSRC) msrc.microsoft.com
• Microsoft Security Update Guide (MSRC, en-US) msrc.microsoft.com
• Strix CVE-2026-119818 (aggregator, unverified builds) www.strix.ai
• VulDB CVE-2026-119818 vuldb.com
• Tenable: November 2026 Patch Tuesday www.tenable.com
• Talos: Microsoft Patch Tuesday November 2026 blog.talosintelligence.com
• Trinetriops: Patch Tuesday November 2026 trinetriops.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:52.