Windows Installerの脆弱性で、ローカルの攻撃者が権限を昇格される恐れ
Summary
Windows Installerに、競合状態により権限を昇格される脆弱性（CVE-2026-119865）が見つかりました。Windows 10 Version 1607・1809・21H2・22H2、Windows 11 Version 23H2・24H2が影響を受け、各版には修正版が公開されています。今回は公表されたばかりで、悪用の情報はありません。修正版の適用を優先してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Windows Installerに、競合状態により権限を昇格される脆弱性（CVE-2026-119865）が見つかりました。Windows 10 Version 1607・1809・21H2・22H2、Windows 11 Version 23H2・24H2が影響を受け、各版には修正版が公開されています。今回は公表されたばかりで、悪用の情報はありません。修正版の適用を優先してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| MicrosoftWindows 10 Version 1607 |
≥ 10.0.14393.0, < 10.0.14393.9612→ 10.0.14393.9612 |
10.0.14393.9612 |
| MicrosoftWindows 10 Version 1809 |
≥ 10.0.17763.0, < 10.0.17763.9376→ 10.0.17763.9376 |
10.0.17763.9376 |
| MicrosoftWindows 10 Version 21H2 |
≥ 10.0.19044.0, < 10.0.19044.7807→ 10.0.19044.7807 |
10.0.19044.7807 |
| MicrosoftWindows 10 Version 22H2 |
≥ 10.0.19045.0, < 10.0.19045.7807→ 10.0.19045.7807 |
10.0.19045.7807 |
| MicrosoftWindows 11 Version 23H2 |
≥ 10.0.22631.0, < 10.0.22631.7652→ 10.0.22631.7652 |
10.0.22631.7652 |
| MicrosoftWindows 11 Version 24H2 |
≥ 10.0.26100.0, < 10.0.26100.9711→ 10.0.26100.9711 |
10.0.26100.9711 |
| MicrosoftWindows 11 Version 25H2 |
≥ 10.0.26200.0, < 10.0.26200.9711→ 10.0.26200.9711 |
10.0.26200.9711 |
| MicrosoftWindows 11 version 26H1 |
≥ 10.0.28000.0, < 10.0.28000.3231→ 10.0.28000.3231 |
10.0.28000.3231 |
| MicrosoftWindows 11 Version 26H2 |
≥ 10.0.26300.0, < 10.0.26300.9711→ 10.0.26300.9711 |
10.0.26300.9711 |
| MicrosoftWindows Server 2012 |
≥ 6.2.9200.0, < 6.2.9200.26434→ 6.2.9200.26434 |
6.2.9200.26434 |
| MicrosoftWindows Server 2012 (Server Core installation) |
≥ 6.2.9200.0, < 6.2.9200.26434→ 6.2.9200.26434 |
6.2.9200.26434 |
| MicrosoftWindows Server 2012 R2 |
≥ 6.3.9600.0, < 6.3.9600.23470→ 6.3.9600.23470 |
6.3.9600.23470 |
| MicrosoftWindows Server 2012 R2 (Server Core installation) |
≥ 6.3.9600.0, < 6.3.9600.23470→ 6.3.9600.23470 |
6.3.9600.23470 |
| MicrosoftWindows Server 2016 |
≥ 10.0.14393.0, < 10.0.14393.9612→ 10.0.14393.9612 |
10.0.14393.9612 |
| MicrosoftWindows Server 2016 (Server Core installation) |
≥ 10.0.14393.0, < 10.0.14393.9612→ 10.0.14393.9612 |
10.0.14393.9612 |
| MicrosoftWindows Server 2019 |
≥ 10.0.17763.0, < 10.0.17763.9376→ 10.0.17763.9376 |
10.0.17763.9376 |
| MicrosoftWindows Server 2019 (Server Core installation) |
≥ 10.0.17763.0, < 10.0.17763.9376→ 10.0.17763.9376 |
10.0.17763.9376 |
| MicrosoftWindows Server 2022 |
≥ 10.0.20348.0, < 10.0.20348.5761→ 10.0.20348.5761 |
10.0.20348.5761 |
| MicrosoftWindows Server 2025 |
≥ 10.0.26100.0, < 10.0.26100.33650→ 10.0.26100.33650 |
10.0.26100.33650 |
| MicrosoftWindows Server 2025 (Server Core installation) |
≥ 10.0.26100.0, < 10.0.26100.33650→ 10.0.26100.33650 |
10.0.26100.33650 |
Original description The description as published by the source.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
Source: Microsoft Security Response Center Blog NVD GitHub Advisory
References
- web msrc.microsoft.com
- web nvd.nist.gov
- web github.com