{"id":"CVE-2026-105547","kind":"vulnerability","aliases":["CVE-2026-105547"],"related":[],"title":"Windows Setup and Deployment: double free lets a local user gain privileges","description":"Double free in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.","summary":"A double free bug in Windows Setup and Deployment lets an attacker who already has authorized local access raise their privileges. The sources give no further detail on the trigger or the affected Windows builds.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Setup and Deployment","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:17:56+00:00","first_seen_at":"2026-11-10T19:24:19+00:00","triaged_at":"2026-11-10T19:54:03+00:00","updated_at":"2026-11-10T19:54:03+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:54:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Setup and Deployment: double free lets a local user gain privileges","impact":"high","summary":"A double free bug in Windows Setup and Deployment lets an attacker who already has authorized local access raise their privileges. The sources give no further detail on the trigger or the affected Windows builds.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on Windows","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-105547 to confirm affected Windows builds and the patch.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Setup and Deployment","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines where a user already has local access are the concern, since the attacker must be authorized on the system first. The sources do not name affected Windows versions or builds. unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000658,"input_tokens":4482,"output_tokens":420,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-105547 to confirm affected Windows builds and the patch.","search":"'-105547':15A,18A '-2026':14A,17A 'access':42B 'affect':57B 'allow':67C 'alreadi':38B 'and':21A 'attack':36B,70C 'author':40B,69C 'bug':28B 'build':59B 'cve':13A,16A 'deploy':4A,33B,66C 'deployment':22A 'detail':51B 'doubl':5A,26B,60C 'elev':72C 'free':6A,27B,61C 'gain':11A 'give':48B 'infrastructur':23B 'let':7A,34B 'local':9A,41B,74C 'privileg':12A,45B,73C 'rais':43B 'setup':2A,20A,31B,64C 'sourc':47B 'trigger':54B 'user':10A 'window':1A,24B,30B,58B,63C 'windows':19A","nicknames":[],"mitigations":[],"who_affected":"Windows machines where a user already has local access are the concern, since the attacker must be authorized on the system first. The sources do not name affected Windows versions or builds. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["setupanddeployment","windowssetupanddeployment"],"ptokens":["and","deployment","setup","windows"],"labels":["high","infrastructure","vendor","windows"],"campaign_type":null,"search_a":"'-105547':15A,18A '-2026':14A,17A 'and':21A 'cve':13A,16A 'deploy':4A 'deployment':22A 'doubl':5A 'free':6A 'gain':11A 'let':7A 'local':9A 'privileg':12A 'setup':2A,20A 'user':10A 'window':1A 'windows':19A","search_b":"'access':42B 'affect':57B 'alreadi':38B 'attack':36B 'author':40B 'bug':28B 'build':59B 'deploy':33B 'detail':51B 'doubl':26B 'free':27B 'give':48B 'infrastructur':23B 'let':34B 'local':41B 'privileg':45B 'rais':43B 'setup':31B 'sourc':47B 'trigger':54B 'window':24B,30B,58B","search_c":"'allow':67C 'attack':70C 'author':69C 'deploy':66C 'doubl':60C 'elev':72C 'free':61C 'local':74C 'privileg':73C 'setup':64C 'window':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105547","severity":null,"published_at":"2026-11-10T19:17:56+00:00","modified_at":"2026-11-10T19:17:57+00:00","first_seen_at":"2026-11-10T19:24:19+00:00","fetched_at":"2026-11-10T19:24:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}