{"id":"CVE-2026-105017","kind":"vulnerability","aliases":["CVE-2026-105017"],"related":[],"title":"Windows Volume Shadow Copy race condition lets a local user gain privileges","description":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Volume Shadow Copy allows an authorized attacker to elevate privileges locally.","summary":"A race condition in the Windows Volume Shadow Copy service lets an authorized local attacker elevate their privileges. The sources do not say which Windows versions are affected or how the flaw is triggered.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","volume-shadow-copy","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:17:41+00:00","first_seen_at":"2026-11-10T19:24:13+00:00","triaged_at":"2026-11-10T19:54:18+00:00","updated_at":"2026-11-10T19:54:18+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:54:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Volume Shadow Copy race condition lets a local user gain privileges","impact":"high","summary":"A race condition in the Windows Volume Shadow Copy service lets an authorized local attacker elevate their privileges. The sources do not say which Windows versions are affected or how the flaw is triggered.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","volume-shadow-copy"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user becomes administrator or SYSTEM on the machine","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-105017 to get affected Windows builds and the patch.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00063,"input_tokens":4510,"output_tokens":357,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-105017 to get affected Windows builds and the patch.","search":"'-105017':15A,18A '-2026':14A,17A 'affect':52B 'allow':74C 'attack':39B,77C 'author':37B,76C 'concurr':59C 'condit':6A,27B,68C 'copi':4A,23B,33B,73C 'cve':13A,16A 'elev':40B,79C 'execut':60C 'flaw':56B 'gain':11A 'improp':65C 'infrastructur':19B 'let':7A,35B 'local':9A,38B,81C 'privileg':12A,42B,80C 'race':5A,26B,67C 'resourc':63C 'say':47B 'servic':34B 'shadow':3A,22B,32B,72C 'share':62C 'sourc':44B 'synchron':66C 'trigger':58B 'use':61C 'user':10A 'version':50B 'volum':2A,21B,31B,71C 'volume-shadow-copi':20B 'window':1A,24B,30B,49B,70C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","volumeshadowcopy","windows"],"campaign_type":null,"search_a":"'-105017':15A,18A '-2026':14A,17A 'condit':6A 'copi':4A 'cve':13A,16A 'gain':11A 'let':7A 'local':9A 'privileg':12A 'race':5A 'shadow':3A 'user':10A 'volum':2A 'window':1A","search_b":"'affect':52B 'attack':39B 'author':37B 'condit':27B 'copi':23B,33B 'elev':40B 'flaw':56B 'infrastructur':19B 'let':35B 'local':38B 'privileg':42B 'race':26B 'say':47B 'servic':34B 'shadow':22B,32B 'sourc':44B 'trigger':58B 'version':50B 'volum':21B,31B 'volume-shadow-copi':20B 'window':24B,30B,49B","search_c":"'allow':74C 'attack':77C 'author':76C 'concurr':59C 'condit':68C 'copi':73C 'elev':79C 'execut':60C 'improp':65C 'local':81C 'privileg':80C 'race':67C 'resourc':63C 'shadow':72C 'share':62C 'synchron':66C 'use':61C 'volum':71C 'window':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105017","severity":null,"published_at":"2026-11-10T19:17:41+00:00","modified_at":"2026-11-10T19:17:41+00:00","first_seen_at":"2026-11-10T19:24:13+00:00","fetched_at":"2026-11-10T19:24:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}