{"id":"CVE-2026-105503","kind":"vulnerability","aliases":["CVE-2026-105503"],"related":[],"title":"Windows Management Instrumentation: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in Windows Management Instrumentation can be triggered by an authorized local user. An attacker who already has a login on the machine can use it to elevate their privileges.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Management Instrumentation","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","windows","wmi"],"not_affected_if":["no-local-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:17:48+00:00","first_seen_at":"2026-11-10T19:24:15+00:00","triaged_at":"2026-11-10T19:42:41+00:00","updated_at":"2026-11-10T19:42:41+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:42:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Management Instrumentation: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in Windows Management Instrumentation can be triggered by an authorized local user. An attacker who already has a login on the machine can use it to elevate their privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","wmi"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Confirm affected Windows builds and the Microsoft security update from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-105503.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Management Instrumentation","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Affects Windows machines where a local user already has an account, since the flaw is triggered locally by an authorized attacker. Systems where only trusted administrators log in are lower exposure. The sources do not say which Windows builds are affected or which updates fix it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000691,"input_tokens":4497,"output_tokens":483,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Windows builds and the Microsoft security update from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-105503.","search":"'-105503':15A,18A '-2026':14A,17A 'allow':69C 'alreadi':46B 'attack':44B,72C 'author':40B,71C 'base':28B,62C 'buffer':29B,63C 'cve':13A,16A 'elev':57B,74C 'gain':10A 'heap':4A,27B,61C 'heap-bas':26B,60C 'higher':11A 'infrastructur':22B 'instrument':3A,34B,68C 'instrumentation':21A 'let':6A 'local':8A,41B,76C 'login':49B 'machin':52B 'manag':2A,33B,67C 'management':20A 'overflow':5A,30B,64C 'privileg':12A,59B,75C 'trigger':37B 'use':54B 'user':9A,42B 'window':1A,23B,32B,66C 'windows':19A 'wmi':24B","nicknames":[],"mitigations":[],"who_affected":"Affects Windows machines where a local user already has an account, since the flaw is triggered locally by an authorized attacker. Systems where only trusted administrators log in are lower exposure. The sources do not say which Windows builds are affected or which updates fix it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["managementinstrumentation","windowsmanagementinstrumentation"],"ptokens":["instrumentation","management","windows"],"labels":["high","infrastructure","vendor","windows","wmi"],"campaign_type":null,"search_a":"'-105503':15A,18A '-2026':14A,17A 'cve':13A,16A 'gain':10A 'heap':4A 'higher':11A 'instrument':3A 'instrumentation':21A 'let':6A 'local':8A 'manag':2A 'management':20A 'overflow':5A 'privileg':12A 'user':9A 'window':1A 'windows':19A","search_b":"'alreadi':46B 'attack':44B 'author':40B 'base':28B 'buffer':29B 'elev':57B 'heap':27B 'heap-bas':26B 'infrastructur':22B 'instrument':34B 'local':41B 'login':49B 'machin':52B 'manag':33B 'overflow':30B 'privileg':59B 'trigger':37B 'use':54B 'user':42B 'window':23B,32B 'wmi':24B","search_c":"'allow':69C 'attack':72C 'author':71C 'base':62C 'buffer':63C 'elev':74C 'heap':61C 'heap-bas':60C 'instrument':68C 'local':76C 'manag':67C 'overflow':64C 'privileg':75C 'window':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105503","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105503","severity":null,"published_at":"2026-11-10T19:17:48+00:00","modified_at":"2026-11-10T19:17:48+00:00","first_seen_at":"2026-11-10T19:24:15+00:00","fetched_at":"2026-11-10T19:24:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}