{"id":"CVE-2026-105504","kind":"vulnerability","aliases":["CVE-2026-105504"],"related":[],"title":"Windows Kernel: memory object handling lets a local user gain elevated privileges","description":"An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.\nTo exploit the vulnerability, a locally authenticated attacker could run a specially crafted application.\nThe security update addresses the vulnerability by ensuring the Windows Kernel properly handles objects in memory.","summary":"The Windows kernel mishandles objects in memory, so a locally logged-in attacker running a crafted application can execute code with elevated permissions. The sources state the security update fixes it by making the kernel handle those objects correctly.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","windows","windows-kernel"],"not_affected_if":["no-local-logins"],"how_to_check":"- Check the installed Windows build and update history under Settings > Windows Update > Update history, looking for the update that addresses this CVE.\n- The sources do not name the affected Windows builds or the KB number: unknown.","fix":null,"status":"open","published_at":"2026-11-10T19:17:48+00:00","first_seen_at":"2026-11-10T19:24:15+00:00","triaged_at":"2026-11-10T19:54:19+00:00","updated_at":"2026-11-10T19:54:19+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:54:19Z","model":"claude-haiku-5-5","output":{"fix":"- Install the Windows security update from Microsoft that addresses CVE-2026-105504; the sources do not name the build or KB: unknown.","reach":"local","title":"Windows Kernel: memory object handling lets a local user gain elevated privileges","impact":"high","summary":"The Windows kernel mishandles objects in memory, so a locally logged-in attacker running a crafted application can execute code with elevated permissions. The sources state the security update fixes it by making the kernel handle those objects correctly.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-kernel","endpoints"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"local attacker runs code with elevated system permissions","analyst_note":"Find the affected Windows builds and the Microsoft security update KB for CVE-2026-105504 at the MSRC advisory page.","how_to_check":"- Check the installed Windows build and update history under Settings > Windows Update > Update history, looking for the update that addresses this CVE.\n- The sources do not name the affected Windows builds or the KB number: unknown.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-logins"],"who_is_affected":"Any Windows machine where a user can log in or run code locally is in scope, since the attacker must already be authenticated on the machine. Servers and workstations both run the Windows kernel, so the update applies broadly. The sources do not list specific Windows versions: unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4581,"output_tokens":561,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and the Microsoft security update KB for CVE-2026-105504 at the MSRC advisory page.","search":"'-105504':15A,18A '-2026':14A,17A 'address':112C 'applic':42B,108C 'attack':38B,83C,102C 'authent':101C 'code':45B,91C 'correct':64B 'could':89C,103C 'craft':41B,107C 'cve':13A,16A 'elev':11A,47B,66C,93C 'endpoint':19B 'ensur':116C 'execut':44B,90C 'exist':70C 'exploit':86C,96C 'fix':55B 'gain':10A 'handl':5A,61B,78C,121C 'infrastructur':20B 'kernel':2A,24B,27B,60B,77C,119C 'let':6A 'local':8A,34B,100C 'log':36B 'logged-in':35B 'make':58B 'memori':3A,31B,81C,124C 'mishandl':28B 'object':4A,29B,63B,79C,122C 'permiss':48B,94C 'privileg':12A,68C 'proper':120C 'run':39B,104C 'secur':53B,110C 'sourc':50B 'special':106C 'state':51B 'success':85C 'updat':54B,111C 'user':9A 'vulner':69C,88C,98C,114C 'way':73C 'window':1A,21B,23B,26B,76C,118C 'windows-kernel':22B","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine where a user can log in or run code locally is in scope, since the attacker must already be authenticated on the machine. Servers and workstations both run the Windows kernel, so the update applies broadly. The sources do not list specific Windows versions: unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["endpoints","high","infrastructure","windows","windowskernel"],"campaign_type":null,"search_a":"'-105504':15A,18A '-2026':14A,17A 'cve':13A,16A 'elev':11A 'gain':10A 'handl':5A 'kernel':2A 'let':6A 'local':8A 'memori':3A 'object':4A 'privileg':12A 'user':9A 'window':1A","search_b":"'applic':42B 'attack':38B 'code':45B 'correct':64B 'craft':41B 'elev':47B 'endpoint':19B 'execut':44B 'fix':55B 'handl':61B 'infrastructur':20B 'kernel':24B,27B,60B 'local':34B 'log':36B 'logged-in':35B 'make':58B 'memori':31B 'mishandl':28B 'object':29B,63B 'permiss':48B 'run':39B 'secur':53B 'sourc':50B 'state':51B 'updat':54B 'window':21B,23B,26B 'windows-kernel':22B","search_c":"'address':112C 'applic':108C 'attack':83C,102C 'authent':101C 'code':91C 'could':89C,103C 'craft':107C 'elev':66C,93C 'ensur':116C 'execut':90C 'exist':70C 'exploit':86C,96C 'handl':78C,121C 'kernel':77C,119C 'local':100C 'memori':81C,124C 'object':79C,122C 'permiss':94C 'privileg':68C 'proper':120C 'run':104C 'secur':110C 'special':106C 'success':85C 'updat':111C 'vulner':69C,88C,98C,114C 'way':73C 'window':76C,118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105504","severity":null,"published_at":"2026-11-10T19:17:48+00:00","modified_at":"2026-11-10T19:17:48+00:00","first_seen_at":"2026-11-10T19:24:15+00:00","fetched_at":"2026-11-10T19:24:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}