CVE-2026-119856: Win32k Information Disclosure Vulnerability

CVE-2026-119856 is an information disclosure vulnerability in Win32k, rated Important by Microsoft, with a CVSS 3.1 base score of 5.5 (Medium). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.49% probability of exploitation activity in the next 30 days, higher than 43% of all scored vulnerabilities. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday, delivered through 10 security updates (KB5131291, KB5131085, KB5131096, KB5131090 and more). It affects 32 products in 3 product families (ESU, Windows, Microsoft Office).

Key facts

CVE ID: CVE-2026-119856
Severity: Medium CVSS 5.5
Microsoft severity: Important
Impact: Information Disclosure
Exploited in the wild: No
Publicly disclosed: No
Exploitation likelihood: Less Likely
Weakness: CWE-497
EPSS: 0.49% (percentile 43%)
CISA KEV: Not listed
Released: 10 November 2026
Last updated: 13 November 2026
Patch Tuesday: November 2026 Patch Tuesday
Product families: ESU, Windows, Microsoft Office

CVSS score and vector

Microsoft scores CVE-2026-119856 at 5.5 (temporal 4.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Metric	Value
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	None
Availability impact	None
Exploit code maturity	Unproven
Remediation level	Official fix
Report confidence	Confirmed

Description

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally.

Frequently asked questions (Microsoft)

What type of information could be disclosed by this vulnerability?

The type of information that could be disclosed if an attacker successfully exploited this vulnerability is a small amount of kernel memory which could be leaked back to the attacker.

Affected products (32)

ESU

Product	Security update	Type	Fixed build	Restart
Windows 10 Version 1607 for 32-bit Systems	KB5131291	Security Update	10.0.14393.9688	Yes
Windows 10 Version 1607 for x64-based Systems	KB5131291	Security Update	10.0.14393.9688	Yes
Windows Server 2016	KB5131291	Security Update	10.0.14393.9688	Yes
Windows Server 2016 (Server Core installation)	KB5131291	Security Update	10.0.14393.9688	Yes
Windows 10 Version 22H2 for 32-bit Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for x64-based Systems

Windows

Product	Security update	Type	Fixed build	Restart
Windows 10 Version 1809 for 32-bit Systems	KB5131085	Security Update	10.0.17763.9487	Yes
Windows 10 Version 1809 for x64-based Systems	KB5131085	Security Update	10.0.17763.9487	Yes
Windows Server 2019	KB5131085	Security Update	10.0.17763.9487	Yes
Windows Server 2019 (Server Core installation)	KB5131085	Security Update	10.0.17763.9487	Yes
Windows 10 Version 21H2 for 32-bit Systems	KB5131096	Security Update	10.0.19044.7846	Yes
Windows 10 Version 21H2 for ARM64-based Systems	KB5131096	Security Update	10.0.19044.7846	Yes
Windows 10 Version 21H2 for x64-based Systems	KB5131096	Security Update	10.0.19044.7846	Yes
Windows Server 2022	KB5131090	Security Update	10.0.20348.5870	Yes
Windows Server 2022 (Server Core installation)	KB5131090	Security Update	10.0.20348.5870	Yes
Windows 11 Version 23H2 for ARM64-based Systems	KB5131087	Security Update	10.0.22631.7711	Yes
Windows 11 Version 23H2 for x64-based Systems	KB5131087	Security Update	10.0.22631.7711	Yes
Windows 11 Version 24H2 for ARM64-based Systems	KB5132061 KB5132043	Security Update Security Update	10.0.26100.9974 10.0.26100.9911	Yes No
Windows 11 Version 24H2 for x64-based Systems	KB5132061 KB5132043	Security Update Security Update	10.0.26100.9974 10.0.26100.9911	Yes No
Windows 11 Version 25H2 for ARM64-based Systems	KB5132043	Security Update	10.0.26200.9911	No
Windows 11 Version 25H2 for x64-based Systems	KB5132043	Security Update	10.0.26200.9911	No
Windows 11 Version 26H2 for ARM64-based Systems	KB5132043	Security Update	10.0.26300.9911	No
Windows 11 Version 26H2 for x64-based Systems	KB5132043	Security Update	10.0.26300.9911	No
Windows Server 2025	KB5131080 KB5131077	Security Update Security Update	10.0.26100.33822 10.0.26100.33730	Yes No
Windows Server 2025 (Server Core installation)	KB5131080 KB5131077	Security Update Security Update	10.0.26100.33822 10.0.26100.33730	Yes No
Windows 11 Version 26H1 for ARM64-based Systems	KB5132059	Security Update	10.0.28000.3501	Yes
Windows 11 version 26H1 for x64-based Systems	KB5132059	Security Update	10.0.28000.3501	Yes

Microsoft Office

Product	Security update	Type	Fixed build
Microsoft Office for Android	Release Notes	Security Update	16.0.20625.20014
Microsoft Office LTSC for Mac 2021	Release Notes	Security Update	16.115.26110837
Microsoft Office LTSC for Mac 2024	Release Notes	Security Update	16.115.26110837
Microsoft Office 365 for Mac	Release Notes	Security Update	16.115.26110837

Security updates (10)

KB5131291 (Security Update)
KB5131085 (Security Update)
KB5131096 (Security Update)
KB5131090 (Security Update)
KB5131087 (Security Update)
KB5132061 (Security Update)
KB5132043 (Security Update)
KB5131080 (Security Update)
KB5131077 (Security Update)
KB5132059 (Security Update)

NIST NVD data

NVD status: Awaiting Analysis
NVD CVSS: 5.5 (MEDIUM)
NVD weakness: CWE-497
Published to NVD: 10 November 2026
NVD last modified: 10 November 2026

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119856

Acknowledgments

Revision history

Version	Date	Description
1.0	10 November 2026	Information published.
1.1	13 November 2026	Added Microsoft Office software to the Security Updates table. Customers that are running supported version of Microsoft Office are encouraged to update to the indicated version to be protected from this vulnerability.