Microsoft Patch Tuesday: November 2026

November 2026: 67 vulnerabilities, one dot each, grouped by product family and colored by severity

In November 2026, Microsoft released security updates for 67 vulnerabilities. 4 are rated critical, 0 were exploited in the wild before the fix, and 0 were publicly disclosed. The most common impacts are information disclosure (1). The most affected product families are Open Source Software (42), Browser (25).

Last change to this release: 5 November 2026.

Previous: October 2026 Patch Tuesday

Exploited and publicly disclosed (0)

No vulnerability in this release was exploited or publicly disclosed before the fix.

Critical vulnerabilities (4)

CVE	Title	Severity	CVSS
CVE-2026-118309	Chromium CVE-2026-118309: Incorrect reference resolution	Critical	9.6
CVE-2026-118321	Chromium CVE-2026-118321: Use after free	Critical	9.6
CVE-2026-119261	Chromium CVE-2026-119261: Improper input validation	Critical	9.6
CVE-2026-119263	Chromium CVE-2026-119263: Memory corruption	Critical	9.6

Severity breakdown

Severity (CVSS)	CVEs
Critical	4
High	22
Medium	30
Low	10
N/A	1

Impact categories

Impact	CVEs
Information Disclosure	1

Product families

Product family	CVEs
Open Source Software	42
Browser	25

All 67 vulnerabilities

CVE	Title	Severity	CVSS	Impact
CVE-2026-122518	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Medium	6.5	Information Disclosure
CVE-2026-118309	Chromium CVE-2026-118309: Incorrect reference resolution	Critical	9.6
CVE-2026-118321	Chromium CVE-2026-118321: Use after free	Critical	9.6
CVE-2026-119261	Chromium CVE-2026-119261: Improper input validation	Critical	9.6
CVE-2026-119263	Chromium CVE-2026-119263: Memory corruption	Critical	9.6
CVE-2026-118314	Chromium CVE-2026-118314: Incorrect reference resolution	High	8.8
CVE-2026-119260	Chromium CVE-2026-119260: Use after free	High	8.8
CVE-2026-119262	Chromium CVE-2026-119262: Improper input validation	High	8.8
CVE-2026-119264	Chromium CVE-2026-119264: Memory corruption	High	8.8
CVE-2026-119265	Chromium CVE-2026-119265: Memory corruption	High	8.8
CVE-2026-119266	Chromium CVE-2026-119266: Use after free	High	8.8
CVE-2026-119267	Chromium CVE-2026-119267: Memory corruption	High	8.8
CVE-2026-119268	Chromium CVE-2026-119268: Integer overflow	High	8.8
CVE-2026-119269	Chromium CVE-2026-119269: Use after free	High	8.8
CVE-2026-119270	Chromium CVE-2026-119270: Improper input validation	High	8.8
CVE-2026-119271	Chromium CVE-2026-119271: Use after free	High	8.8
CVE-2026-76025	Chromium CVE-2026-76025: Use after free	High	8.8
CVE-2026-76026	Chromium CVE-2026-76026: Memory corruption	High	8.8
CVE-2026-76028	Chromium CVE-2026-76028: Use after free	High	8.8
CVE-2026-76029	Chromium CVE-2026-76029: Memory corruption	High	8.8
CVE-2026-76030	Chromium CVE-2026-76030: Memory corruption	High	8.8
CVE-2026-76031	Chromium CVE-2026-76031: Use after free	High	8.8
CVE-2026-99246	tipc: protect node reset trace dump with node lock	High	8.1
CVE-2026-99270	tcp: Fix potential UAF in reqsk_timer_handler().	High	8.1
CVE-2026-119741	rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions	High	7.5
CVE-2026-120830	Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure	High	7.4
CVE-2026-120757	Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverse	High	7.1
CVE-2026-115715	Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service	Medium	6.5
CVE-2026-120831	Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service	Medium	6.5
CVE-2026-76024	Chromium CVE-2026-76024: Memory corruption	Medium	6.5
CVE-2026-120756	Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize	Medium	6.1
CVE-2026-120755	Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter	Medium	5.5
CVE-2026-120758	NULL Pointer Dereference in H5HL_unprotect via Corrupted File	Medium	5.5
CVE-2026-99220	asymmetric_keys: reject trust keys without IDs	Medium	5.5
CVE-2026-99229	io_uring/wait: don't spin on a stuck overflow list	Medium	5.5
CVE-2026-99236	tracing: Reject incomplete event filter expressions	Medium	5.5
CVE-2026-99254	io_uring: don't flood a cancelling task with task_work	Medium	5.5
CVE-2026-120457	libaec through 1.1.7 Out-of-Bounds Read via m_se_decode() Second Extension Decoder	Medium	5.3
CVE-2026-99224	keys: Protect the type name while describing a key	Medium	5.3
CVE-2026-99218	coredump: hold RCU while releasing parked threads	Medium	4.7
CVE-2026-99222	keys: Protect the read method check against type removal	Medium	4.7
CVE-2026-99225	keys: Check the authorization payload in process keyring searches	Medium	4.7
CVE-2026-99226	keys: Avoid the owner account dereference in named keyring lookup	Medium	4.7
CVE-2026-99243	io-wq: order the exit bit against worker creation task work	Medium	4.7
CVE-2026-99245	KEYS: Fix key_reject_and_link() race with keyring restriction	Medium	4.7
CVE-2026-99255	io_uring/io-wq: don't hide a link from cancellations	Medium	4.7
CVE-2026-99262	io_uring/timeout: don't lose a cancel as io-wq arms a timeout	Medium	4.7
CVE-2026-99233	tracing/histograms: Verify event_call identity when updating synth_event refcount	Medium	4.4
CVE-2026-99235	tracing: Save the event file instead of the compatible histogram	Medium	4.4
CVE-2026-115298	Incorrect Authorization in Elasticsearch Leading to Information Disclosure	Medium	4.3
CVE-2026-119272	Chromium CVE-2026-119272: Out of bounds read	Medium	4.3
CVE-2026-76027	Chromium CVE-2026-76027: Memory corruption	Medium	4.3
CVE-2026-115710	Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure	Medium	4.2
CVE-2026-99219	ftrace: Initialize modname and offset in print_rec()	Medium	4.1
CVE-2026-99247	tracing: Do not initialize tracefs work if tracing is disabled	Medium	4.1
CVE-2026-99251	Drivers: hv: Avoid infinite retry loop in init_vp_index()	Medium	4.1
CVE-2026-99234	tracing: Unregister field variable histograms when the command fails	Low	3.4
CVE-2026-120754	Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter	Low	3.3
CVE-2026-99223	keys: make keyring indexes independent of kernel addresses	Low	3.3
CVE-2026-99260	ntfs: fix resident conversion in ntfs_new_attr_flags	Low	3.3
CVE-2026-99261	drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction	Low	3.3
CVE-2026-99268	io_uring: wake ring pollers for local task_work	Low	3.3
CVE-2026-99221	keys/trusted_keys: return immediately after TPM unseal failure	Low	2.5
CVE-2026-99249	pid_namespace: make zap_pid_ns_processes() freezable	Low	2.5
CVE-2026-99263	io_uring/poll: avoid retry wakeup loss when dropping ownership	Low	2.5
CVE-2026-99256	dm cache: fix issue with background work locking	Low	2.3
CVE-2026-120689	Uncontrolled Recursion in HDF5 H5B__iterate_helper() via Crafted File	N/A