{"id":"CVE-2026-105587","kind":"vulnerability","aliases":["CVE-2026-105587"],"related":[],"title":"Windows OLE DB: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows OLE DB allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in Windows OLE DB lets an attacker who already has an account on the machine raise their privileges. The sources do not describe the exact trigger or the affected Windows builds.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows OLE DB","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","ole-db","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:01+00:00","first_seen_at":"2026-11-10T19:24:21+00:00","triaged_at":"2026-11-10T19:53:55+00:00","updated_at":"2026-11-10T19:53:55+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:53:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows OLE DB: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in Windows OLE DB lets an attacker who already has an account on the machine raise their privileges. The sources do not describe the exact trigger or the affected Windows builds.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","ole-db"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows machine","analyst_note":"Check the Microsoft security update guide entry for this CVE to get affected Windows builds and the patch.","how_to_check":"- unknown","plain_action":"","product_name":"Windows OLE DB","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines where OLE DB is present, which covers most Windows systems. An attacker needs a local logon first, so shared servers and multi-user hosts carry more risk than single-user desktops. The sources do not list affected Windows versions.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000672,"input_tokens":4492,"output_tokens":446,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft security update guide entry for this CVE to get affected Windows builds and the patch.","search":"'-105587':15A,18A '-2026':14A,17A 'account':44B 'affect':61B 'allow':73C 'alreadi':41B 'attack':39B,76C 'author':75C 'base':30B,66C 'buffer':31B,67C 'build':63B 'cve':13A,16A 'db':3A,21A,25B,36B,72C 'describ':55B 'elev':78C 'exact':57B 'gain':10A 'heap':4A,29B,65C 'heap-bas':28B,64C 'higher':11A 'infrastructur':22B 'let':6A,37B 'local':8A,80C 'machin':47B 'ole':2A,20A,24B,35B,71C 'ole-db':23B 'overflow':5A,32B,68C 'privileg':12A,50B,79C 'rais':48B 'sourc':52B 'trigger':58B 'user':9A 'window':1A,26B,34B,62B,70C 'windows':19A","nicknames":[],"mitigations":[],"who_affected":"Windows machines where OLE DB is present, which covers most Windows systems. An attacker needs a local logon first, so shared servers and multi-user hosts carry more risk than single-user desktops. The sources do not list affected Windows versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["oledb","windowsoledb"],"ptokens":["db","ole","windows"],"labels":["high","infrastructure","oledb","vendor","windows"],"campaign_type":null,"search_a":"'-105587':15A,18A '-2026':14A,17A 'cve':13A,16A 'db':3A,21A 'gain':10A 'heap':4A 'higher':11A 'let':6A 'local':8A 'ole':2A,20A 'overflow':5A 'privileg':12A 'user':9A 'window':1A 'windows':19A","search_b":"'account':44B 'affect':61B 'alreadi':41B 'attack':39B 'base':30B 'buffer':31B 'build':63B 'db':25B,36B 'describ':55B 'exact':57B 'heap':29B 'heap-bas':28B 'infrastructur':22B 'let':37B 'machin':47B 'ole':24B,35B 'ole-db':23B 'overflow':32B 'privileg':50B 'rais':48B 'sourc':52B 'trigger':58B 'window':26B,34B,62B","search_c":"'allow':73C 'attack':76C 'author':75C 'base':66C 'buffer':67C 'db':72C 'elev':78C 'heap':65C 'heap-bas':64C 'local':80C 'ole':71C 'overflow':68C 'privileg':79C 'window':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105587","severity":null,"published_at":"2026-11-10T19:18:01+00:00","modified_at":"2026-11-10T19:18:01+00:00","first_seen_at":"2026-11-10T19:24:21+00:00","fetched_at":"2026-11-10T19:24:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}