Nov 2026: Microsoft Windows Search Component Elevation of Privilege Vulnerability
CVE-2026-119954 Published on November 10, 2026
Microsoft Windows Search Component Elevation of Privilege Vulnerability
Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
Vulnerability Analysis
Weakness Types
Absolute Path Traversal
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory. This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Products Associated with CVE-2026-119954
Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.
Affected Versions
Microsoft Windows 10 Version 1809:- Version 10.0.17763.0 and below 10.0.17763.9487 is affected.
- Version 10.0.19044.0 and below 10.0.19044.7846 is affected.
- Version 10.0.19045.0 and below 10.0.19045.7846 is affected.
- Version 10.0.22631.0 and below 10.0.22631.7711 is affected.
- Version 10.0.22631.0 and below 10.0.22631.7711 is affected.
- Version 10.0.26100.0 and below 10.0.26100.9974 is affected.
- Version 10.0.26200.0 and below 10.0.26200.9974 is affected.
- Version 10.0.28000.0 and below 10.0.28000.3501 is affected.
- Version 10.0.26300.0 and below 10.0.26300.9974 is affected.
- Version 10.0.17763.0 and below 10.0.17763.9487 is affected.
- Version 10.0.17763.0 and below 10.0.17763.9487 is affected.
- Version 10.0.20348.0 and below 10.0.20348.5870 is affected.
- Version 10.0.26100.0 and below 10.0.26100.33822 is affected.
- Version 10.0.26100.0 and below 10.0.26100.33822 is affected.