{"id":"CVE-2026-109473","kind":"vulnerability","aliases":["CVE-2026-109473"],"related":[],"title":"Windows Kernel: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in the Windows kernel lets an attacker who already has a logged-on account on the machine raise their privileges. The sources give no detail on the exact trigger or affected builds.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"- Check the Windows build with `winver` and compare it against the update list in the NVD entry for CVE-2026-109473","fix":null,"status":"open","published_at":"2026-11-10T19:18:16+00:00","first_seen_at":"2026-11-10T19:24:24+00:00","triaged_at":"2026-11-10T19:42:25+00:00","updated_at":"2026-11-10T19:42:25+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:42:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Kernel: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in the Windows kernel lets an attacker who already has a logged-on account on the machine raise their privileges. The sources give no detail on the exact trigger or affected builds.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","kernel"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level control of the machine","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-109473 to get affected Windows builds and the patch.","how_to_check":"- Check the Windows build with `winver` and compare it against the update list in the NVD entry for CVE-2026-109473\n- unknown for anything more specific, as the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Any Windows machine where an untrusted or low-privileged user can log on or run code locally may be exposed. The sources do not list which Windows builds are affected or which features are needed, so the team should check the vendor's advisory for the affected versions. Machines where only administrators log on are lower risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":4476,"output_tokens":501,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-109473 to get affected Windows builds and the patch.","search":"'-109473':16A,19A '-2026':15A,18A 'account':43B 'affect':60B 'allow':68C 'alreadi':37B 'attack':35B,71C 'author':70C 'bug':28B 'build':61B 'cve':14A,17A 'detail':54B 'elev':73C 'exact':57B 'free':6A,27B,64C 'gain':11A 'give':52B 'higher':12A 'infrastructur':20B 'kernel':2A,21B,32B,67C 'let':7A,33B 'local':9A,75C 'log':41B 'logged-on':40B 'machin':46B 'privileg':13A,49B,74C 'rais':47B 'sourc':51B 'trigger':58B 'use':4A,25B,62C 'use-after-fre':3A,24B 'user':10A 'window':1A,22B,31B,66C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine where an untrusted or low-privileged user can log on or run code locally may be exposed. The sources do not list which Windows builds are affected or which features are needed, so the team should check the vendor's advisory for the affected versions. Machines where only administrators log on are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","kernel","windows"],"campaign_type":null,"search_a":"'-109473':16A,19A '-2026':15A,18A 'cve':14A,17A 'free':6A 'gain':11A 'higher':12A 'kernel':2A 'let':7A 'local':9A 'privileg':13A 'use':4A 'use-after-fre':3A 'user':10A 'window':1A","search_b":"'account':43B 'affect':60B 'alreadi':37B 'attack':35B 'bug':28B 'build':61B 'detail':54B 'exact':57B 'free':27B 'give':52B 'infrastructur':20B 'kernel':21B,32B 'let':33B 'log':41B 'logged-on':40B 'machin':46B 'privileg':49B 'rais':47B 'sourc':51B 'trigger':58B 'use':25B 'use-after-fre':24B 'window':22B,31B","search_c":"'allow':68C 'attack':71C 'author':70C 'elev':73C 'free':64C 'kernel':67C 'local':75C 'privileg':74C 'use':62C 'window':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109473","severity":null,"published_at":"2026-11-10T19:18:16+00:00","modified_at":"2026-11-10T19:18:16+00:00","first_seen_at":"2026-11-10T19:24:24+00:00","fetched_at":"2026-11-10T19:24:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}