{"id":"CVE-2026-105522","kind":"vulnerability","aliases":["CVE-2026-105522"],"related":[],"title":"Windows Winlogon: use-after-free lets an authorized user gain higher privileges locally","description":"Use after free in Winlogon allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in Windows Winlogon, the logon component, lets an attacker who already has an authorized local account raise their privileges. The sources give a CVSS score of 7.0 and no fixed version.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows","winlogon"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:17:51+00:00","first_seen_at":"2026-11-10T19:24:17+00:00","triaged_at":"2026-11-10T19:54:11+00:00","updated_at":"2026-11-10T19:54:11+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:54:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Winlogon: use-after-free lets an authorized user gain higher privileges locally","impact":"high","summary":"A use-after-free bug in Windows Winlogon, the logon component, lets an attacker who already has an authorized local account raise their privileges. The sources give a CVSS score of 7.0 and no fixed version.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","winlogon"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Find the Microsoft advisory for CVE-2026-105522 to confirm affected Windows builds and the patch.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Winlogon","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines where users have local logon access are the likely exposure, since the attacker must already be authorized on the system. The sources do not list affected Windows builds or whether a patch exists, so unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000668,"input_tokens":4472,"output_tokens":442,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft advisory for CVE-2026-105522 to confirm affected Windows builds and the patch.","search":"'-105522':17A,20A '-2026':16A,19A '7.0':56B 'account':45B 'allow':66C 'alreadi':40B 'attack':38B,69C 'author':9A,43B,68C 'bug':29B 'compon':35B 'cve':15A,18A 'cvss':53B 'elev':71C 'fix':59B 'free':6A,28B,63C 'gain':11A 'give':51B 'higher':12A 'infrastructur':21B 'let':7A,36B 'local':14A,44B,73C 'logon':34B 'privileg':13A,48B,72C 'rais':46B 'score':54B 'sourc':50B 'use':4A,26B,61C 'use-after-fre':3A,25B 'user':10A 'version':60B 'window':1A,22B,31B 'winlogon':2A,23B,32B,65C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where users have local logon access are the likely exposure, since the attacker must already be authorized on the system. The sources do not list affected Windows builds or whether a patch exists, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows","winlogon"],"campaign_type":null,"search_a":"'-105522':17A,20A '-2026':16A,19A 'author':9A 'cve':15A,18A 'free':6A 'gain':11A 'higher':12A 'let':7A 'local':14A 'privileg':13A 'use':4A 'use-after-fre':3A 'user':10A 'window':1A 'winlogon':2A","search_b":"'7.0':56B 'account':45B 'alreadi':40B 'attack':38B 'author':43B 'bug':29B 'compon':35B 'cvss':53B 'fix':59B 'free':28B 'give':51B 'infrastructur':21B 'let':36B 'local':44B 'logon':34B 'privileg':48B 'rais':46B 'score':54B 'sourc':50B 'use':26B 'use-after-fre':25B 'version':60B 'window':22B,31B 'winlogon':23B,32B","search_c":"'allow':66C 'attack':69C 'author':68C 'elev':71C 'free':63C 'local':73C 'privileg':72C 'use':61C 'winlogon':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105522","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105522","severity":null,"published_at":"2026-11-10T19:17:51+00:00","modified_at":"2026-11-10T19:17:51+00:00","first_seen_at":"2026-11-10T19:24:17+00:00","fetched_at":"2026-11-10T19:24:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}