Microsoft Windows: Use-after-free in NetBIOS allows local privilege escalation

Summary

Windows NetBIOS contains a use-after-free flaw (CWE-416) that allows privilege escalation. An attacker needs local access and a low-privilege account, and the attack is harder to execute (AC:H). Microsoft rates the CVSS 3.1 base score at 7.0, while VulDB shows 8.8; Microsoft's score is the reference.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016, including Server Core (10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019, including Server Core (10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)
• Windows Server 2025: unconfirmed, not listed in the CVE record

Fixed in

• Fixed builds per the CVE record: see the affected build numbers above (first fixed build of each branch)
• KB numbers: Unknown.
• Expected in the November 2026 Patch Tuesday updates, not yet confirmed by Microsoft's bulletin

Workaround

Unknown.

• No vendor-documented workaround found. Patching is the only confirmed remedy.
• Disabling NetBIOS over TCP/IP is general hardening; its effect on this flaw is unknown.

Exploitation

• Microsoft's assessment: exploit maturity E:U (unproven) in the CVSS vector.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public exploit or PoC found in the research; not known to be exploited in the wild.

Our recommendation

• Install the November 2026 cumulative update on all affected Windows clients and servers, starting with terminal servers and shared machines.
• Verify affected builds and KB numbers on the MSRC advisory page before rollout.
• Review local administrator rights and apply least-privilege policies, since exploitation requires a local foothold.
• Recheck NVD and VulDB in a few days for changes to score, exploitation or PoC status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-119873 msrc.microsoft.com
• CVE Record CVE-2026-119873 www.cve.org
• VulDB entry 434194 vuldb.com
• Vulnerability-Lookup (CIRCL) vulnerability.circl.lu

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:35.