November 2026 Patch Tuesday lists dozens of Microsoft flaws
Original title: Patch Tuesday - November 2026
The excerpt lists 57 CVEs, including CVSS 9.8 remote code execution bugs rated exploitation less likely.
Rapid7's November 2026 Patch Tuesday roundup catalogs Microsoft vulnerabilities across Windows components, with scores from 3.3 to 9.8. Several Color Management and DirectMusic issues are rated 9.8 for remote code execution, and Microsoft marks them exploitation less likely. Three elevation-of-privilege bugs are rated exploitation more likely. The post is cut off, and no in-the-wild exploitation is stated.
Unconfirmed: The excerpt is truncated, and exploitability labels are assessments, not confirmed attacks.
- CVE-2026-96067 and CVE-2026-96078 in Color Management are CVSS 9.8 RCE.
- CVE-2026-95882 and CVE-2026-95901 in DirectMusic are also CVSS 9.8 RCE.
- More likely: Active Directory Domain Services, Data Sharing Service Client, and Desktop Window Manager elevation of privilege.
- AMD Zen information-disclosure issues CVE-2026-84004 and CVE-2026-84005 are scored 5.5.
- Each listed flaw is followed by No; the list ends mid-entry.
Impact: Elevation of privilege, remote code execution, or information disclosure
| Product | Affected |
|---|---|
| Microsoft Windows components including Color Management, DirectMusic, Desktop Window Manager, and Active Directory Domain Services | — |
| AMD Zen | — |
- 1.Install Microsoft's November 2026 security updates for the listed components.
- CVEs
- CVE-2026-118148CVE-2026-118735CVE-2026-123387CVE-2026-119889CVE-2026-84004CVE-2026-84005CVE-2026-96007CVE-2026-119883CVE-2026-95963CVE-2026-105528CVE-2026-105581CVE-2026-113819CVE-2026-96103CVE-2026-96172CVE-2026-96174CVE-2026-96175CVE-2026-94507CVE-2026-96084CVE-2026-88211CVE-2026-119969CVE-2026-100204CVE-2026-114164CVE-2026-114165CVE-2026-114167CVE-2026-96059CVE-2026-122173CVE-2026-125135CVE-2026-96010CVE-2026-96974CVE-2026-96979
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-100204 | Use-after-free in HEIF Image Extensions (local, user interaction) | 7.0 | — | ||
| CVE-2026-105581 | Stack buffer overflow in Desktop Window Manager (local EoP) | 8.8 group max | — | ||
CVE-2026-114164+2 related CVEs | Integer underflow RCE in Windows Codecs Library | 8.8 group max | — | ||
CVE-2026-118148+1 related CVE | Privilege escalation in Active Directory Domain Services | 7.5 | — | ||
| CVE-2026-119883 | Local authorization bypass in Microsoft Data Deduplication | 3.3 | — | ||
| CVE-2026-119889 | Out-of-bounds read in Microsoft ActiveSyncProvider | 6.5 | — | ||
CVE-2026-119969+2 related CVEs | Heap buffer overflow in Microsoft Graphic Fonts | 8.8 group max | — | ||
CVE-2026-96010+4 related CVEs | Integer underflow privilege escalation in Microsoft HID Parser Library | 8.8 group max | — | ||
| CVE-2026-123387 | Command injection privilege escalation in Windows Active Directory | 8.0 | — | ||
CVE-2026-84004+1 related CVE | Local information disclosure in AMD Zen processors | 5.5 | — | ||
| CVE-2026-94507 | Local privilege escalation via heap overflow in Windows DirectX | 7.8 | — | ||
| CVE-2026-95963 | Local privilege escalation via link following in Data Sharing Service Client | 7.8 | — | ||
| CVE-2026-96007 | Local use-after-free privilege escalation in Cdpsvc | 7.0 | — | ||
| CVE-2026-96059 | Use-after-free information disclosure in Microsoft HID class driver | 5.5 | — |
From the original article
10 min read at rapid7.com
Microsoft is publishing 1,092 own-product vulnerabilities on November 2026 Patch Tuesday, including 1,102 vulnerabilities in Windows. Until a few months ago, these volumes would have been unimaginable, but if anything, this month feels like a slight reprieve.
By Adam Barnett · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.