Microsoft Windows Kernel: Information disclosure through buffer over-read

Summary

A buffer over-read in the Windows kernel allows an authorized, low-privileged local user to read kernel memory and disclose information. The attack requires a logged-in account and no user interaction, and it affects confidentiality only. Microsoft rates it Medium (CVSS 5.5), and no public exploit or active exploitation is known.

Affected

• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)
• Windows Server 2025 including Server Core (10.0.26100.0 to before 10.0.26100.33822)

Note: the CVE record and aggregators differ on some builds; verify against the MSRC Security Update Guide.

Fixed in

• Fixed in the November 2026 Windows security update.
• Fixed builds per the CVE record: 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2), 10.0.28000.3501 (26H1).
• Other fixed builds are listed in the MSRC Security Update Guide, which is the authoritative source.

Workaround

Unknown. No workaround is documented in the sources; patching is the only documented remedy.

Exploitation

• No public exploit or proof of concept found.
• Not known to be exploited in the wild.
• CISA SSVC: exploitation none, automatable no, technical impact partial.
• EPSS score: unknown.

Our recommendation

• Install the November 2026 Windows security update on all affected systems, prioritising terminal servers, RDS hosts and shared workstations with multiple user logins.
• Verify the installed build against the MSRC Security Update Guide before and after rollout.
• Restrict local logons to trusted users and monitor for unusual local activity on multi-user systems until patched.
• Monitor for public exploit code and update the priority if exploitation is reported.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-119857 www.cve.org
• Microsoft Security Update Guide CVE-2026-119857 msrc.microsoft.com
• VulDB entry 435144 vuldb.com
• Senserva KB5132059 senserva.com
• SANS ISC diary archive isc.sans.edu
• Strix CVE-2026-119857 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:44.