{"id":"CVE-2026-105024","kind":"vulnerability","aliases":["CVE-2026-105024"],"related":[],"title":"Windows Storage Spaces Controller: use-after-free lets a local user gain privileges","description":"Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in the Windows Storage Spaces Controller lets an attacker who already has a local account raise their privileges. The attacker gets higher rights on the affected Windows machine than they were given.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","storage-spaces","windows"],"not_affected_if":["no-storage-spaces"],"how_to_check":"- Check the Windows build with `winver` and compare it against Microsoft's security update guide entry for CVE-2026-105024\n- Confirm whether Storage Spaces is in use with `Get-StoragePool` in PowerShell","fix":null,"status":"open","published_at":"2026-11-10T19:17:43+00:00","first_seen_at":"2026-11-10T19:24:13+00:00","triaged_at":"2026-11-10T19:54:20+00:00","updated_at":"2026-11-10T19:54:20+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:54:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Storage Spaces Controller: use-after-free lets a local user gain privileges","impact":"high","summary":"A use-after-free bug in the Windows Storage Spaces Controller lets an attacker who already has a local account raise their privileges. The attacker gets higher rights on the affected Windows machine than they were given.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","storage-spaces"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the Windows machine","analyst_note":"Find the affected Windows builds and patch KB from Microsoft's security update guide for CVE-2026-105024 (https://nvd.nist.gov/vuln/detail/CVE-2026-105024).","how_to_check":"- Check the Windows build with `winver` and compare it against Microsoft's security update guide entry for CVE-2026-105024\n- Confirm whether Storage Spaces is in use with `Get-StoragePool` in PowerShell","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-storage-spaces"],"who_is_affected":"Windows machines that run the Storage Spaces Controller and have local user accounts an attacker could use. The sources do not list affected Windows builds or a patched version. Servers and workstations that never use Storage Spaces are less likely to be exposed, but the sources do not confirm this.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4488,"output_tokens":559,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and patch KB from Microsoft's security update guide for CVE-2026-105024 (https://nvd.nist.gov/vuln/detail/CVE-2026-105024).","search":"'-105024':17A,20A '-2026':16A,19A 'account':46B 'affect':57B 'allow':72C 'alreadi':42B 'attack':40B,51B,75C 'author':74C 'bug':31B 'control':4A,37B,71C 'cve':15A,18A 'elev':77C 'free':8A,30B,66C 'gain':13A 'get':52B 'given':63B 'higher':53B 'infrastructur':21B 'let':9A,38B 'local':11A,45B,79C 'machin':59B 'privileg':14A,49B,78C 'rais':47B 'right':54B 'space':3A,24B,36B,70C 'storag':2A,23B,35B,69C 'storage-spac':22B 'use':6A,28B,64C 'use-after-fre':5A,27B 'user':12A 'window':1A,25B,34B,58B,68C","nicknames":[],"mitigations":[],"who_affected":"Windows machines that run the Storage Spaces Controller and have local user accounts an attacker could use. The sources do not list affected Windows builds or a patched version. Servers and workstations that never use Storage Spaces are less likely to be exposed, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","storagespaces","windows"],"campaign_type":null,"search_a":"'-105024':17A,20A '-2026':16A,19A 'control':4A 'cve':15A,18A 'free':8A 'gain':13A 'let':9A 'local':11A 'privileg':14A 'space':3A 'storag':2A 'use':6A 'use-after-fre':5A 'user':12A 'window':1A","search_b":"'account':46B 'affect':57B 'alreadi':42B 'attack':40B,51B 'bug':31B 'control':37B 'free':30B 'get':52B 'given':63B 'higher':53B 'infrastructur':21B 'let':38B 'local':45B 'machin':59B 'privileg':49B 'rais':47B 'right':54B 'space':24B,36B 'storag':23B,35B 'storage-spac':22B 'use':28B 'use-after-fre':27B 'window':25B,34B,58B","search_c":"'allow':72C 'attack':75C 'author':74C 'control':71C 'elev':77C 'free':66C 'local':79C 'privileg':78C 'space':70C 'storag':69C 'use':64C 'window':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105024","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105024","severity":null,"published_at":"2026-11-10T19:17:43+00:00","modified_at":"2026-11-10T19:17:43+00:00","first_seen_at":"2026-11-10T19:24:13+00:00","fetched_at":"2026-11-10T19:24:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}