CVE-2026-119872

MediumCVSS 6.4/10Last modified Nov 10, 2026

Description

Heap-based buffer overflow in Windows USB Driver allows an unauthorized attacker to elevate privileges with a physical attack.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1198737.0Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally.CVE-2026-1198747.0Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.CVE-2026-1198754.0Numeric truncation error in Windows Storport Miniport Driver allows an authorized attacker to disclose information with a physical attack.CVE-2026-1198767.0Heap-based buffer overflow in Windows USB Scanner Driver allows an authorized attacker to elevate privileges locally.CVE-2026-119886.5The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object RefereCVE-2026-1198807.5Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to execute code over a network.CVE-2026-1198818.8Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to elevate privileges over a network.CVE-2026-1198825.3Exposure of sensitive system information to an unauthorized control sphere in Windows Remote Desktop Services allows an authorized attacker CVE-2026-1198833.3Improper authorization in Data Deduplication allows an authorized attacker to bypass a security feature locally.CVE-2026-1198846.8Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1198856.8Heap-based buffer overflow in Windows Storport Miniport Driver allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1198867.8Missing authentication for critical function in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
CVE-2026-119872: Medium severity, CVSS 6.4 | Vulnix