{"id":"CVE-2026-112796","kind":"vulnerability","aliases":["CVE-2026-112796"],"related":[],"title":"Windows Event Collector: double free lets a local user gain higher privileges","description":"Double free in Windows Event Collector Service allows an authorized attacker to elevate privileges locally.","summary":"A double free bug in the Windows Event Collector Service lets a user who already has an account on the machine raise their privileges. The attacker gets elevated rights on the local system.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-collector","infrastructure","self-hosted","windows"],"not_affected_if":["no-local-users","service-not-running"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:41+00:00","first_seen_at":"2026-11-10T19:24:33+00:00","triaged_at":"2026-11-10T19:53:38+00:00","updated_at":"2026-11-10T19:53:38+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:53:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Event Collector: double free lets a local user gain higher privileges","impact":"high","summary":"A double free bug in the Windows Event Collector Service lets a user who already has an account on the machine raise their privileges. The attacker gets elevated rights on the local system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","event-collector","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local user gains elevated system privileges on the machine","analyst_note":"Check the Microsoft security update guide for CVE-2026-112796 for affected Windows builds, the patch version and whether the Event Collector service must be enabled.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users","service-not-running"],"who_is_affected":"Machines running the Windows Event Collector Service, which is a Windows component for gathering event logs from other machines. Exposure requires an authorized local account, so systems without shared or untrusted local users are at lower risk. The sources do not list affected Windows builds.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00067,"input_tokens":4480,"output_tokens":444,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft security update guide for CVE-2026-112796 for affected Windows builds, the patch version and whether the Event Collector service must be enabled.","search":"'-112796':15A,18A '-2026':14A,17A 'account':44B 'allow':67C 'alreadi':41B 'attack':52B,70C 'author':69C 'bug':30B 'collector':3A,21B,35B,65C 'cve':13A,16A 'doubl':4A,28B,60C 'elev':54B,72C 'event':2A,20B,34B,64C 'event-collector':19B 'free':5A,29B,61C 'gain':10A 'get':53B 'higher':11A 'host':25B 'infrastructur':22B 'let':6A,37B 'local':8A,58B,74C 'machin':47B 'privileg':12A,50B,73C 'rais':48B 'right':55B 'self':24B 'self-host':23B 'servic':36B,66C 'system':59B 'user':9A,39B 'window':1A,26B,33B,63C","nicknames":[],"mitigations":[],"who_affected":"Machines running the Windows Event Collector Service, which is a Windows component for gathering event logs from other machines. Exposure requires an authorized local account, so systems without shared or untrusted local users are at lower risk. The sources do not list affected Windows builds.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eventcollector","high","infrastructure","selfhosted","windows"],"campaign_type":null,"search_a":"'-112796':15A,18A '-2026':14A,17A 'collector':3A 'cve':13A,16A 'doubl':4A 'event':2A 'free':5A 'gain':10A 'higher':11A 'let':6A 'local':8A 'privileg':12A 'user':9A 'window':1A","search_b":"'account':44B 'alreadi':41B 'attack':52B 'bug':30B 'collector':21B,35B 'doubl':28B 'elev':54B 'event':20B,34B 'event-collector':19B 'free':29B 'get':53B 'host':25B 'infrastructur':22B 'let':37B 'local':58B 'machin':47B 'privileg':50B 'rais':48B 'right':55B 'self':24B 'self-host':23B 'servic':36B 'system':59B 'user':39B 'window':26B,33B","search_c":"'allow':67C 'attack':70C 'author':69C 'collector':65C 'doubl':60C 'elev':72C 'event':64C 'free':61C 'local':74C 'privileg':73C 'servic':66C 'window':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112796","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112796","severity":null,"published_at":"2026-11-10T19:18:41+00:00","modified_at":"2026-11-10T19:18:41+00:00","first_seen_at":"2026-11-10T19:24:33+00:00","fetched_at":"2026-11-10T19:24:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}