Microsoft Windows Installer: Information disclosure via out-of-bounds read

Summary

Microsoft Windows Installer, the built-in component for installing, repairing and removing MSI packages, contains an out-of-bounds read. An authorized local user with low privileges can disclose information. The attack complexity is high, the flaw cannot be exploited remotely, and no exploitation is known.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9974)
• Windows Server 2016 including Server Core (10.0.14393.0 to < 10.0.14393.9688)
• Windows Server 2019 including Server Core (10.0.17763.0 to < 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to < 10.0.20348.5870)

Fixed in

• Build numbers as listed in the CVE record (CNA: Microsoft); verify against the MSRC advisory before relying on them.
• Windows 10 21H2 and 22H2: 10.0.19044.7846 and 10.0.19045.7846 (third-party sources conflict for 21H2).
• Windows 10 Version 1607: 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.9487
• Windows 11 Version 23H2: 10.0.22631.7711
• Windows 11 Version 24H2, 25H2 and 26H2: 10.0.26100.9974, 10.0.26200.9974 and 10.0.26300.9974
• Windows 11 Version 26H1: 10.0.28000.3501
• Windows Server 2016: 10.0.14393.9688
• Windows Server 2022: 10.0.20348.5870
• Cumulative updates for November 2026 (per third-party KB summaries): KB5132061 (Windows 11 24H2/25H2/26H2), KB5132059 (Windows 11 26H1), KB5131085 (Windows 10 1809 and Server 2019).

Workaround

Unknown. No vendor-documented workaround was identified. Installing the November 2026 cumulative update is the effective remedy.

Exploitation

• No confirmed in-the-wild exploitation.
• Rapid7 rates exploitation as less likely and reports no public disclosure.
• CISA SSVC: exploitation none, not automatable.
• No public proof of concept found.

Our recommendation

• Install the November 2026 Windows security updates in the normal monthly cycle.
• Prioritize multi-user systems, terminal servers, and hosts running Windows 10 1607/1809 or Windows Server 2016/2019.
• Verify build numbers against the MSRC advisory before deployment.
• Limit local logon rights on shared systems.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-119838 msrc.microsoft.com
• CVE Record CVE-2026-119838 (CNA: Microsoft) www.cve.org
• BleepingComputer: Microsoft November 2026 Patch Tuesday www.bleepingcomputer.com
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Senserva KB5132061 (Windows 11 24H2/25H2/26H2) senserva.com
• Senserva KB5132059 (Windows 11 26H1) senserva.com
• Senserva KB5131085 (Windows 10 1809 and Server 2019) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:51.