CVE-2026-119921

HighCVSS 7.0/10Last modified Nov 10, 2026

Description

Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122CWE-190

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1199228.8Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon AurorCVE-2026-1199239.8A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-CVE-2026-1199248.1An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4CVE-2026-1199258.8Out-of-bounds read in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.CVE-2026-1199287.0Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2026-1199297.8Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-119934.3Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurreCVE-2026-1199317.0Time-of-check time-of-use (toctou) race condition in Windows Text Services Framework allows an authorized attacker to elevate privileges locCVE-2026-1199327.5Null pointer dereference in Windows Remote Desktop allows an unauthorized attacker to deny service over a network.CVE-2026-1199337.8Use of uninitialized resource in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-1199348.8Double free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2026-1199356.8Integer underflow (wrap or wraparound) in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-119921: High severity, CVSS 7.0 | Vulnix