Microsoft Windows NTFS: Elevation of privilege through out-of-bounds read

Summary

A out-of-bounds read flaw (CWE-125) in the Windows NTFS file system allows an authorized local user to elevate privileges. An attacker needs an existing low-privileged account and must get a user to interact with the system, so this is a follow-on step after a foothold rather than an initial entry point. Successful exploitation could affect confidentiality, integrity and availability (CVSS 3.1: 7.3 HIGH).

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016 and Server Core (10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019 and Server Core (10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)

Fixed in

• Fixed builds per CVE record upper bounds: 10.0.14393.9688 (Server 2016 / 1607), 10.0.17763.9487 (Server 2019 / 1809), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.28000.3501 (26H1), 10.0.26300.9974 (26H2), 10.0.20348.5870 (Server 2022)
• Cumulative update / KB number: Unknown.
• Verify the exact fixed builds on the MSRC advisory before deployment.

Workaround

Unknown.

• No Microsoft mitigation has been identified for this CVE; the patch is the remedy.

Exploitation

• Exploited in the wild: no evidence found at the time of research.
• Public proof of concept: none found.
• CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.

Our recommendation

• Include the update in the next regular Windows patch cycle.
• Deploy earlier on multi-user systems such as terminal/RDS servers, file servers and shared workstations.
• Limit local logon on servers and shared machines to trusted staff.
• Watch for unexpected SYSTEM-level processes or new local accounts.
• Recheck MSRC and CISA KEV if the advisory changes or exploitation is reported.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-119900 msrc.microsoft.com
• CVE Record CVE-2026-119900 www.cve.org
• Strix AI: CVE-2026-119900 (secondary, unverified fixed builds) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:27.