Windows Installer: Heap-based buffer overflow allows local privilege escalation

Summary

A heap-based buffer overflow in Windows Installer allows an authorized local user to elevate privileges on affected Windows systems. Exploitation requires an existing local account with low privileges and is not possible over the network. Microsoft rates the CVSS 3.1 base score at 7.0 (High), and CISA SSVC lists exploitation as none and automatable as no.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2016 (including Server Core installation): 10.0.14393.0 to before 10.0.14393.9688
• Windows Server 2019 (including Server Core installation): 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Install the Microsoft security update of November 10, 2026 (Patch Tuesday) for your Windows version.
• Fixed builds per Microsoft's CNA record: 10.0.14393.9688 (Windows 10 1607, Server 2016), 10.0.17763.9487 (Windows 10 1809, Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.28000.3501 (26H1), 10.0.26300.9974 (26H2), 10.0.20348.5870 (Server 2022).
• KB article numbers: Unknown. Verify on the MSRC update guide.

Workaround

Unknown. No workaround is listed by Microsoft in the sources reviewed.

Exploitation

• No evidence of exploitation in the wild found for this CVE.
• No public proof-of-concept exploit found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• Microsoft CVSS temporal vector includes E:U (exploit code maturity unproven).

Our recommendation

• Deploy the November 2026 Windows security update on all Windows endpoints and servers with priority, as a standard Patch Tuesday item.
• Check first for Windows 10 1607, 1809 and 21H2 systems. These may be out of support or on older builds and require an upgrade path.
• Restrict interactive local logon to trusted users, especially on shared PCs, terminal servers and RDS hosts.
• Verify KB numbers and fixed builds on the MSRC page before rollout.
• Check whether CVE-2026-83680, a similar Windows Installer heap overflow from October 2026, is also patched.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119831 msrc.microsoft.com
• CVE Record CVE-2026-119831 (CVE Program) www.cve.org
• VulDB entry 434174 vuldb.com
• Rapid7 Patch Tuesday November 2026 www.rapid7.com
• Tenable Microsoft November 2026 Patch Tuesday www.tenable.com
• Qualys Microsoft Patch Tuesday November 2026 review blog.qualys.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:44.