IT SBIT Services
Schneeberger
DEEN
CVE tracker

Windows COM+ Event System Service: Information disclosure through buffer over-read

CVE-2026-119855Medium 5.5

← All vulnerabilities

Summary

Microsoft has fixed a buffer over-read in the Windows COM+ Event System Service on supported Windows 10, Windows 11 and Windows Server systems. An authorized local user can read memory contents beyond the intended buffer. The flaw affects confidentiality only, requires local logon with a low-privilege account, and is not exposed directly from the network.

Affected

  • Windows 10 Version 1607 (builds before 10.0.14393.9688)
  • Windows 10 Version 1809 (builds before 10.0.17763.9487)
  • Windows 10 Version 21H2 (builds before 10.0.19044.7846)
  • Windows 10 Version 22H2 (builds before 10.0.19045.7846)
  • Windows 11 Version 23H2 (builds before 10.0.22631.7711)
  • Windows 11 Version 24H2 (builds before 10.0.26100.9974)
  • Windows 11 Version 25H2 (builds before 10.0.26200.9974)
  • Windows 11 Version 26H1 (builds before 10.0.28000.3501)
  • Windows 11 Version 26H2 (builds before 10.0.26300.9974)
  • Windows Server 2016 including Server Core (builds before 10.0.14393.9688)
  • Windows Server 2019 including Server Core (builds before 10.0.17763.9487)
  • Windows Server 2022 (builds before 10.0.20348.5870)

Fixed in

  • Install the November 2026 security update for the affected Windows version (fixed builds as listed above).
  • Example: KB5131085 for Windows Server 2019 and 1809, according to a third-party write-up. Verify the KB list in the MSRC advisory.

Workaround

Unknown.

  • No documented workaround. Limit local logon on multi-user systems and terminal servers to trusted users.

Exploitation

  • CISA SSVC: exploitation none, not automatable, partial technical impact.
  • Rapid7 rates exploitation as less likely and reports no public disclosure.
  • No confirmed in-the-wild exploitation and not in the CISA KEV catalogue, according to Senserva.
  • No public proof of concept found.

Our recommendation

  • Apply the November 2026 Windows security update in the normal monthly patch cycle.
  • Prioritise the critical pre-authentication Schannel RCE from the same release.
  • Check multi-user systems, terminal servers and shared workstations first.
  • Also patch the October 2026 COM+ heap overflow CVE-2026-83830, which is more serious.

Information from Microsoft (Patch Tuesday November 2026)

Severity (Microsoft)
Important
Impact
Information disclosure – Windows COM+ Event System Service
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:42.

Original description (NVD)

Buffer over-read in Windows COM+ Event System Service allows an authorized attacker to disclose information locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed