CVE-2026-119876

HighCVSS 7.0/10Last modified Nov 10, 2026

Description

Heap-based buffer overflow in Windows USB Scanner Driver allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-119886.5The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object RefereCVE-2026-1198807.5Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to execute code over a network.CVE-2026-1198818.8Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to elevate privileges over a network.CVE-2026-1198825.3Exposure of sensitive system information to an unauthorized control sphere in Windows Remote Desktop Services allows an authorized attacker CVE-2026-1198833.3Improper authorization in Data Deduplication allows an authorized attacker to bypass a security feature locally.CVE-2026-1198846.8Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1198856.8Heap-based buffer overflow in Windows Storport Miniport Driver allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1198867.8Missing authentication for critical function in Windows Telephony Service allows an authorized attacker to elevate privileges locally.CVE-2026-1198876.5Use of uninitialized resource in Windows Installer allows an unauthorized attacker to disclose information over a network.CVE-2026-1198887.0Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.CVE-2026-1198896.5Out-of-bounds read in ActiveSyncProvider allows an unauthorized attacker to disclose information over a network.CVE-2026-119896.5The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Server-Sid
CVE-2026-119876: High severity, CVSS 7.0 | Vulnix