Microsoft has patched CVE-2026-119948, a high-severity buffer overflow in Windows Active Directory that could let an authorized attacker execute code over a network. The flaw carries a CVSS 3.1 score of 7.5 and was included in the company’s November 10, 2026 security updates.
Microsoft describes the issue as a stack-based buffer overflow. Exploitation requires low privileges and has high attack complexity, but does not require user interaction. The vulnerability affects multiple Windows 10 and Windows 11 releases, as well as Windows Server 2016, 2019, 2022 and 2025. It is not an unauthenticated attack against any reachable Windows system.
The fixes are included in Microsoft’s November cumulative updates. Examples include Windows 11 version 23H2 build 22631.7711 in KB5131087, Windows Server 2022 build 20348.5870 in KB5131090, and Windows Server 2025 build 26100.33822 in KB5131080. Microsoft’s CVE-2026-119948 advisory lists additional affected and fixed product versions.
The vulnerability is part of Microsoft’s November security release, following an October Patch Tuesday that fixed a record 1,411 flaws, as covered in Abijita’s October 2026 Patch Tuesday report. Windows Server 2022 is among the affected platforms and remains in extended support through October 2031, as detailed in Abijita’s Windows Server 2022 support update.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
