Microsoft Windows Kernel: Double free allows local privilege escalation

Summary

A double free vulnerability (CWE-415) in the Windows kernel allows a local attacker to elevate privileges to SYSTEM. The attacker must already hold high privileges on the system, such as an administrator session, so this is a privilege-escalation step after an initial compromise rather than an entry point. The CVSS base score is 6.7 (Medium). Microsoft addresses the issue in the November 2026 security update.

Affected

• Windows 10 Version 1607 and Windows Server 2016: builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019: builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2 and 25H2: builds before 10.0.26100.9974 and 10.0.26200.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows 11 Version 26H2: builds before 10.0.26300.9974
• Windows Server 2022: builds before 10.0.20348.5870

Note: The sources differ on the complete list (for example, Windows Server 2025). Verify on the MSRC page.

Fixed in

• November 2026 security update (released 2026-11-10) for the affected Windows versions, installing a build at or above the fixed build listed above.
• Exact KB numbers per build: unconfirmed, verify on Microsoft's pages.

Workaround

Unknown.

Exploitation

• Not known to be exploited in the wild (Senserva).
• Not publicly disclosed; no public proof of concept found (Rapid7: exploitation less likely).
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• NVD analysis was pending at the time of the request.

Our recommendation

• Install the November 2026 Windows security update on all affected systems, prioritising servers and admin workstations.
• Windows 10 1607, 1809 and 21H2 require ESU enrolment or an upgrade to receive the fix.
• Verify the affected and fixed builds and KB numbers on the MSRC Security Update Guide before rollout.
• Restrict local administrative access and monitor for unexpected privilege changes or new SYSTEM processes.
• Include this CVE in the normal monthly patch cycle (medium priority).

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119912 msrc.microsoft.com
• CVE.org CNA record CVE-2026-119912 www.cve.org
• Rapid7: Patch Tuesday November 2026 (EM) www.rapid7.com
• Rapid7: Patch Tuesday November 2026 exploitation overview www.rapid7.com
• Senserva KB 5132059 (Windows 11 26H1) senserva.com
• Senserva KB 5132061 (Windows 11 24H2/25H2/26H2) senserva.com
• Senserva KB 5131085 (Windows 10 1809/Server 2019) senserva.com
• Strix.ai: CVE-2026-119912 (third-party, unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:31.