Windows Distributed Transaction Coordinator: Local privilege escalation

Summary

A heap-based buffer overflow in the Windows Distributed Transaction Coordinator (MSDTC) allows an authorized local attacker to elevate privileges. The attack requires local access with a low-privileged account and high attack complexity, so it is not directly reachable from the internet. Successful exploitation would give the attacker high confidentiality, integrity and availability impact on the affected system.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)

Fixed in

• Install the November 2026 Patch Tuesday security update for the affected Windows version.
• Fixed builds: 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.26300.9974, 10.0.28000.3501, 10.0.20348.5870 (Server 2022).
• The KB number is unknown; check the MSRC advisory for the exact update.

Workaround

Unknown. No vendor workaround is documented.

• Interim measure (not from the vendor): if MSDTC is not required, stop and disable the service.
• Restrict local logon rights on servers and terminal or file servers.

Exploitation

• No exploitation in the wild is known for this CVE.
• No public proof-of-concept is known.
• Exploit code maturity is marked as unproven in the CVE record.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• The exploited November 2026 zero-day is reported as a different CVE (CVE-2026-85880).

Our recommendation

• Patch affected systems with the November 2026 security update, prioritising servers and shared terminal or file servers with MSDTC running.
• Disable MSDTC on systems where it is not needed.
• Limit local logon rights and review accounts with local access.
• Verify the affected versions and the KB number against the MSRC advisory before rollout.
• Monitor for unusual privilege changes or service crashes in msdtc.exe.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-119919 msrc.microsoft.com
• CVE.org CVE Record CVE-2026-119919 (Microsoft CNA) www.cve.org
• Strix.ai: CVE-2026-119919 (secondary) www.strix.ai
• Wikipedia: Microsoft Distributed Transaction Coordinator en.wikipedia.org
• batcmd: MSDTC service details batcmd.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:28.