CVE-2026-119882

MediumCVSS 5.3/10Last modified Nov 10, 2026

Description

Exposure of sensitive system information to an unauthorized control sphere in Windows Remote Desktop Services allows an authorized attacker to disclose information over a network.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-497

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1198833.3Improper authorization in Data Deduplication allows an authorized attacker to bypass a security feature locally.CVE-2026-1198846.8Heap-based buffer overflow in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1198856.8Heap-based buffer overflow in Windows Storport Miniport Driver allows an unauthorized attacker to elevate privileges with a physical attack.CVE-2026-1198867.8Missing authentication for critical function in Windows Telephony Service allows an authorized attacker to elevate privileges locally.CVE-2026-1198876.5Use of uninitialized resource in Windows Installer allows an unauthorized attacker to disclose information over a network.CVE-2026-1198887.0Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.CVE-2026-1198896.5Out-of-bounds read in ActiveSyncProvider allows an unauthorized attacker to disclose information over a network.CVE-2026-119896.5The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Server-SidCVE-2026-1198905.3Out-of-bounds read in Windows DHCP Server allows an authorized attacker to deny service over a network.CVE-2026-1198927.8Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-1198937.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Audio Service allows an authorized atCVE-2026-1198947.0Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.
CVE-2026-119882: Medium severity, CVSS 5.3 | Vulnix