{"id":"CVE-2026-105581","kind":"vulnerability","aliases":["CVE-2026-105581"],"related":[],"title":"Windows Desktop Window Manager: stack overflow lets a local user gain admin rights","description":"Stack-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","summary":"Desktop Window Manager, the Windows component that draws the desktop and windows, has a stack-based buffer overflow. An attacker who already has a local account can use it to elevate privileges on the machine.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Desktop Window Manager","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["desktop-window-manager","infrastructure","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:00+00:00","first_seen_at":"2026-11-10T19:24:21+00:00","triaged_at":"2026-11-10T19:34:04+00:00","updated_at":"2026-11-10T19:34:04+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:34:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Desktop Window Manager: stack overflow lets a local user gain admin rights","impact":"high","summary":"Desktop Window Manager, the Windows component that draws the desktop and windows, has a stack-based buffer overflow. An attacker who already has a local account can use it to elevate privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","desktop-window-manager"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Confirm affected Windows builds and the Microsoft patch version from the MSRC advisory for CVE-2026-105581.","how_to_check":"- unknown","plain_action":"","product_name":"Desktop Window Manager","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Windows machines where a user already has a local account could be elevated to higher privileges through this flaw. The sources do not list affected Windows builds or the patch to apply. Systems where no untrusted users log in locally are lower risk.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000684,"input_tokens":4494,"output_tokens":469,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Windows builds and the Microsoft patch version from the MSRC advisory for CVE-2026-105581.","search":"'-105581':16A,19A '-2026':15A,18A 'account':55B 'admin':12A 'allow':74C 'alreadi':51B 'attack':49B,77C 'author':76C 'base':45B,67C 'buffer':46B,68C 'compon':34B 'cve':14A,17A 'desktop':2A,20A,24B,29B,38B,71C 'desktop-window-manag':23B 'draw':36B 'elev':60B,79C 'gain':11A 'infrastructur':27B 'let':7A 'local':9A,54B,81C 'machin':64B 'manag':4A,26B,31B,73C 'manager':22A 'overflow':6A,47B,69C 'privileg':61B,80C 'right':13A 'stack':5A,44B,66C 'stack-bas':43B,65C 'use':57B 'user':10A 'window':1A,3A,21A,25B,28B,30B,33B,40B,72C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where a user already has a local account could be elevated to higher privileges through this flaw. The sources do not list affected Windows builds or the patch to apply. Systems where no untrusted users log in locally are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["desktopwindowmanager","windowmanager"],"ptokens":["desktop","manager","window"],"labels":["desktopwindowmanager","high","infrastructure","vendor","windows"],"campaign_type":null,"search_a":"'-105581':16A,19A '-2026':15A,18A 'admin':12A 'cve':14A,17A 'desktop':2A,20A 'gain':11A 'let':7A 'local':9A 'manag':4A 'manager':22A 'overflow':6A 'right':13A 'stack':5A 'user':10A 'window':1A,3A,21A","search_b":"'account':55B 'alreadi':51B 'attack':49B 'base':45B 'buffer':46B 'compon':34B 'desktop':24B,29B,38B 'desktop-window-manag':23B 'draw':36B 'elev':60B 'infrastructur':27B 'local':54B 'machin':64B 'manag':26B,31B 'overflow':47B 'privileg':61B 'stack':44B 'stack-bas':43B 'use':57B 'window':25B,28B,30B,33B,40B","search_c":"'allow':74C 'attack':77C 'author':76C 'base':67C 'buffer':68C 'desktop':71C 'elev':79C 'local':81C 'manag':73C 'overflow':69C 'privileg':80C 'stack':66C 'stack-bas':65C 'window':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105581","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105581","severity":null,"published_at":"2026-11-10T19:18:00+00:00","modified_at":"2026-11-10T19:18:00+00:00","first_seen_at":"2026-11-10T19:24:21+00:00","fetched_at":"2026-11-10T19:24:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}