Microsoft November 2026 Patch Tuesday covers dozens of Windows flaws
Original title: Patch Tuesday - November 2026
The visible Rapid7 list includes several 9.8 remote code execution bugs; each entry is marked not publicly disclosed.
Rapid7's November 2026 Patch Tuesday post lists Microsoft fixes across Active Directory, Desktop Window Manager, graphics, media extensions, HID, HTTP.sys, PowerShell, and other Windows components. Entries include remote code execution, elevation of privilege, information disclosure, and denial of service, with CVSS scores up to 9.8. Exploitation is rated unlikely, less likely, or more likely; the excerpt does not say any flaw is being attacked. The list is cut off at Microsoft Raw Image Extension.
Unconfirmed: The excerpt is truncated, so the full set of November fixes is not shown.
- Microsoft Color Management and DirectMusic include remote code execution flaws scored 9.8.
- One Desktop Window Manager elevation-of-privilege bug is rated exploitation more likely.
- Two AMD Zen information-disclosure issues are scored 5.5.
- Every fully shown entry ends with public disclosure marked No.
- The excerpt stops during CVE-2026-114166.
Impact: Remote code execution or privilege elevation on Windows components
| Product | Affected |
|---|---|
| Microsoft Active Directory Domain Services | — |
| Microsoft Desktop Window Manager | — |
| Microsoft Color Management | — |
| Microsoft DirectMusic | — |
| AMD Zen | — |
- 1.Install Microsoft's November 2026 security updates for the listed components.
- CVEs
- CVE-2026-118148CVE-2026-118735CVE-2026-123387CVE-2026-119889CVE-2026-84004CVE-2026-84005CVE-2026-96007CVE-2026-119883CVE-2026-95963CVE-2026-105528CVE-2026-105581CVE-2026-113819CVE-2026-96103CVE-2026-96172CVE-2026-96174CVE-2026-96175CVE-2026-94507CVE-2026-96084CVE-2026-88211CVE-2026-119969CVE-2026-100204CVE-2026-114164CVE-2026-114165CVE-2026-114167CVE-2026-96059CVE-2026-122173CVE-2026-125135CVE-2026-96010CVE-2026-96974CVE-2026-96979
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-100204 | Use-after-free in HEIF Image Extensions (local, user interaction) | 7.0 | — | ||
| CVE-2026-105581 | Stack buffer overflow in Desktop Window Manager (local EoP) | 8.8 group max | — | ||
CVE-2026-114164+2 related CVEs | Integer underflow RCE in Windows Codecs Library | 8.8 group max | — | ||
CVE-2026-118148+1 related CVE | Privilege escalation in Active Directory Domain Services | 7.5 | — | ||
| CVE-2026-119883 | Local authorization bypass in Microsoft Data Deduplication | 3.3 | — | ||
| CVE-2026-119889 | Out-of-bounds read in Microsoft ActiveSyncProvider | 6.5 | — | ||
CVE-2026-119969+2 related CVEs | Heap buffer overflow in Microsoft Graphic Fonts | 8.8 group max | — | ||
CVE-2026-96010+4 related CVEs | Integer underflow privilege escalation in Microsoft HID Parser Library | 8.8 group max | — | ||
| CVE-2026-123387 | Command injection privilege escalation in Windows Active Directory | 8.0 | — | ||
CVE-2026-84004+1 related CVE | Local information disclosure in AMD Zen processors | 5.5 | — | ||
| CVE-2026-94507 | Local privilege escalation via heap overflow in Windows DirectX | 7.8 | — | ||
| CVE-2026-95963 | Local privilege escalation via link following in Data Sharing Service Client | 7.8 | — | ||
| CVE-2026-96007 | Local use-after-free privilege escalation in Cdpsvc | 7.0 | — | ||
| CVE-2026-96059 | Use-after-free information disclosure in Microsoft HID class driver | 5.5 | — |
From the original article
10 min read at rapid7.com
Microsoft is publishing 1,092 own-product vulnerabilities on November 2026 Patch Tuesday, including 1,102 vulnerabilities in Windows. Until a few months ago, these volumes would have been unimaginable, but if anything, this month feels like a slight reprieve.
By Adam Barnett · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.