CVE-2026-119942

MediumCVSS 4.7/10Last modified Nov 10, 2026

Description

Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-497

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1199437.8Buffer over-read in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.CVE-2026-1199447.5Heap-based buffer overflow in Windows Mobile Device Management allows an unauthorized attacker to elevate privileges over a network.CVE-2026-1199458.1Use after free in Windows Modern Device Management (MDM) allows an unauthorized attacker to execute code over a network.CVE-2026-1199465.9Improper access control in Windows HTTP.sys allows an unauthorized attacker to disclose information over a network.CVE-2026-1199477.5Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.CVE-2026-1199487.5Stack-based buffer overflow in Windows Active Directory allows an authorized attacker to execute code over a network.CVE-2026-119955.3The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to aut CVE-2026-1199508.8Heap-based buffer overflow in Windows Print Spooler Components allows an unauthorized attacker to elevate privileges over a network.CVE-2026-1199518.1Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.CVE-2026-1199528.1Observable timing discrepancy in Windows Schannel allows an unauthorized attacker to execute code over a network.CVE-2026-1199537.8Use after free in Windows DNS allows an authorized attacker to elevate privileges locally.CVE-2026-1199547.8Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.