{"id":"CVE-2026-105510","kind":"vulnerability","aliases":["CVE-2026-105510"],"related":[],"title":"Windows SSTP: use-after-free lets an authorized user gain privileges locally","description":"Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in the Windows Secure Socket Tunneling Protocol (SSTP) component lets an attacker who already has an account on the machine raise their privileges. The flaw is only reachable locally, so an attacker must already be able to run code or log in there.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","sstp","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:17:49+00:00","first_seen_at":"2026-11-10T19:24:17+00:00","triaged_at":"2026-11-10T19:54:16+00:00","updated_at":"2026-11-10T19:54:16+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:54:16Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Windows SSTP: use-after-free lets an authorized user gain privileges locally","impact":"high","summary":"A use-after-free bug in the Windows Secure Socket Tunneling Protocol (SSTP) component lets an attacker who already has an account on the machine raise their privileges. The flaw is only reachable locally, so an attacker must already be able to run code or log in there.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","sstp"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker gains elevated privileges on the local Windows machine","analyst_note":"Check Microsoft's MSRC advisory for CVE-2026-105510 for affected Windows builds, the patch, and whether SSTP must be enabled.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Windows machines with the SSTP component present, such as Remote Access servers and clients that use SSTP VPNs. The sources do not say which Windows builds are affected or whether non-default configuration is needed. Systems where no one holds a local account can likely skip it, but the sources do not confirm this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000692,"input_tokens":4506,"output_tokens":482,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check Microsoft's MSRC advisory for CVE-2026-105510 for affected Windows builds, the patch, and whether SSTP must be enabled.","search":"'-105510':16A,19A '-2026':15A,18A 'abl':64B 'account':45B 'allow':80C 'alreadi':42B,62B 'attack':40B,60B,83C 'author':9A,82C 'bug':28B 'code':67B 'compon':37B 'cve':14A,17A 'elev':85C 'flaw':53B 'free':6A,27B,72C 'gain':11A 'infrastructur':20B 'let':7A,38B 'local':13A,57B,87C 'log':69B 'machin':48B 'must':61B 'privileg':12A,51B,86C 'protocol':35B,78C 'rais':49B 'reachabl':56B 'run':66B 'secur':32B,75C 'socket':33B,76C 'sstp':2A,21B,36B,79C 'tunnel':34B,77C 'use':4A,25B,70C 'use-after-fre':3A,24B 'user':10A 'window':1A,22B,31B,74C","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the SSTP component present, such as Remote Access servers and clients that use SSTP VPNs. The sources do not say which Windows builds are affected or whether non-default configuration is needed. Systems where no one holds a local account can likely skip it, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","sstp","windows"],"campaign_type":null,"search_a":"'-105510':16A,19A '-2026':15A,18A 'author':9A 'cve':14A,17A 'free':6A 'gain':11A 'let':7A 'local':13A 'privileg':12A 'sstp':2A 'use':4A 'use-after-fre':3A 'user':10A 'window':1A","search_b":"'abl':64B 'account':45B 'alreadi':42B,62B 'attack':40B,60B 'bug':28B 'code':67B 'compon':37B 'flaw':53B 'free':27B 'infrastructur':20B 'let':38B 'local':57B 'log':69B 'machin':48B 'must':61B 'privileg':51B 'protocol':35B 'rais':49B 'reachabl':56B 'run':66B 'secur':32B 'socket':33B 'sstp':21B,36B 'tunnel':34B 'use':25B 'use-after-fre':24B 'window':22B,31B","search_c":"'allow':80C 'attack':83C 'author':82C 'elev':85C 'free':72C 'local':87C 'privileg':86C 'protocol':78C 'secur':75C 'socket':76C 'sstp':79C 'tunnel':77C 'use':70C 'window':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105510","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105510","severity":null,"published_at":"2026-11-10T19:17:49+00:00","modified_at":"2026-11-10T19:17:49+00:00","first_seen_at":"2026-11-10T19:24:17+00:00","fetched_at":"2026-11-10T19:24:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}