Windows Kernel Streaming Service Driver: Heap overflow allows privilege escalation

Summary

A heap-based buffer overflow in the Windows Kernel Streaming Service driver allows an authorized local user to elevate privileges to SYSTEM. The attack requires physical access to the device and a valid low-privilege account. The CVSS score is 6.6 (medium), and Microsoft has released patches in its November 2026 updates.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688\n- Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487\n- Windows 10 Version 21H2 and 22H2: builds before 10.0.19044.7846 and 10.0.19045.7846\n- Windows 11 Version 23H2: builds before 10.0.22631.7711\n- Windows 11 Version 24H2, 25H2, 26H1, 26H2 and Windows Server 2022: see the fixed build list\n- Note: the CVE record's list is partly truncated; verify against the MSRC advisory.

Fixed in

• Install the November 2026 security updates for your Windows version.\n- Minimum fixed builds per the CVE record: 10.0.14393.9688 (1607/Server 2016), 10.0.17763.9487 (1809/Server 2019), 10.0.22631.7711 (23H2), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.20348.5870 (Server 2022), 10.0.28000.3501 (26H1).\n- Windows 11 24H2 fixed build: the CVE record lists 10.0.26100.9974, while the research notes cite 10.0.26100.33822. Unknown until verified in the MSRC table.

Workaround

Unknown. No vendor-documented workaround. Patching is the recommended fix.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.\n- Rapid7 rates exploitation as less likely; no public disclosure found.\n- No public proof-of-concept or known exploitation found at time of review.\n- Not listed in the CISA KEV catalog as of the last check.

Our recommendation

• Install the November 2026 Windows security updates on all affected systems, prioritising shared PCs, reception and kiosk machines, and meeting-room systems.\n- Confirm the fixed build for your edition in the MSRC advisory before rollout.\n- For Windows 10 1607/1809 and Windows Server 2016/2019, check ESU enrolment, as these editions may no longer receive regular updates.\n- Restrict physical access to endpoints, enable full-disk encryption, and use screen locks and session timeouts (defensive measures, not vendor guidance).\n- Monitor for unusual privilege changes on endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119937 msrc.microsoft.com
• CVE Record CVE-2026-119937 www.cve.org
• Rapid7 Patch Tuesday November 2026 www.rapid7.com
• Senserva KB5131085 (Windows 10 1809 / Server 2019) senserva.com
• Senserva KB5132059 (Windows 11 26H1) senserva.com
• SANS ISC diary isc.sans.edu
• Strix CVE-2026-119937 (third-party, build numbers differ) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:43.