{"id":"CVE-2026-112790","kind":"vulnerability","aliases":["CVE-2026-112790"],"related":[],"title":"Windows Kernel: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in the Windows kernel lets an attacker who already has a local account raise their privileges. The sources give no further detail on the trigger or the affected Windows builds.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","kernel","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update guide entry for CVE-2026-112790.\n- Confirm Windows Update has installed the latest cumulative update: `Get-HotFix`.","fix":null,"status":"open","published_at":"2026-11-10T19:18:40+00:00","first_seen_at":"2026-11-10T19:24:32+00:00","triaged_at":"2026-11-10T19:53:42+00:00","updated_at":"2026-11-10T19:53:42+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:53:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Kernel: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in the Windows kernel lets an attacker who already has a local account raise their privileges. The sources give no further detail on the trigger or the affected Windows builds.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","kernel","endpoints"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM privileges on the Windows machine","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-112790 to get affected builds and the fixed update.","how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update guide entry for CVE-2026-112790.\n- Confirm Windows Update has installed the latest cumulative update: `Get-HotFix`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Any Windows machine where an untrusted or low-privilege user can run code locally is potentially exposed. The sources do not list the affected Windows builds or the patch. Servers with only trusted administrators logged in carry less exposure.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":4476,"output_tokens":502,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-112790 to get affected builds and the fixed update.","search":"'-112790':16A,19A '-2026':15A,18A 'account':42B 'affect':57B 'allow':66C 'alreadi':38B 'attack':36B,69C 'author':68C 'bug':29B 'build':59B 'cve':14A,17A 'detail':51B 'elev':71C 'endpoint':20B 'free':6A,28B,62C 'gain':11A 'give':48B 'higher':12A 'infrastructur':21B 'kernel':2A,22B,33B,65C 'let':7A,34B 'local':9A,41B,73C 'privileg':13A,45B,72C 'rais':43B 'sourc':47B 'trigger':54B 'use':4A,26B,60C 'use-after-fre':3A,25B 'user':10A 'window':1A,23B,32B,58B,64C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine where an untrusted or low-privilege user can run code locally is potentially exposed. The sources do not list the affected Windows builds or the patch. Servers with only trusted administrators logged in carry less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["endpoints","high","infrastructure","kernel","windows"],"campaign_type":null,"search_a":"'-112790':16A,19A '-2026':15A,18A 'cve':14A,17A 'free':6A 'gain':11A 'higher':12A 'kernel':2A 'let':7A 'local':9A 'privileg':13A 'use':4A 'use-after-fre':3A 'user':10A 'window':1A","search_b":"'account':42B 'affect':57B 'alreadi':38B 'attack':36B 'bug':29B 'build':59B 'detail':51B 'endpoint':20B 'free':28B 'give':48B 'infrastructur':21B 'kernel':22B,33B 'let':34B 'local':41B 'privileg':45B 'rais':43B 'sourc':47B 'trigger':54B 'use':26B 'use-after-fre':25B 'window':23B,32B,58B","search_c":"'allow':66C 'attack':69C 'author':68C 'elev':71C 'free':62C 'kernel':65C 'local':73C 'privileg':72C 'use':60C 'window':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112790","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112790","severity":null,"published_at":"2026-11-10T19:18:40+00:00","modified_at":"2026-11-10T19:18:40+00:00","first_seen_at":"2026-11-10T19:24:32+00:00","fetched_at":"2026-11-10T19:24:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}