{"id":"CVE-2026-121673","kind":"vulnerability","aliases":["CVE-2026-121673"],"related":[],"title":"Windows Filter Manager: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Filter Manager allows an authorized attacker to elevate privileges locally.","summary":"A memory-safety bug in the Windows Filter Manager driver lets a user who already has local access corrupt memory and elevate their privileges. An attacker who can run code on the machine can gain system-level rights.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["filter-manager","infrastructure","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"- Check the Windows build with `winver` or `systeminfo` and compare it to the fixed build in Microsoft's security update guide, which the sources do not name.\n- Confirm Windows Update has installed the latest cumulative update for the machine.","fix":null,"status":"open","published_at":"2026-11-10T19:20:30+00:00","first_seen_at":"2026-11-10T19:25:09+00:00","triaged_at":"2026-11-10T19:39:00+00:00","updated_at":"2026-11-10T19:39:00+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:39:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Filter Manager: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A memory-safety bug in the Windows Filter Manager driver lets a user who already has local access corrupt memory and elevate their privileges. An attacker who can run code on the machine can gain system-level rights.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","filter-manager"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM privileges on the machine","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-121673 to get affected builds and the fixed update.","how_to_check":"- Check the Windows build with `winver` or `systeminfo` and compare it to the fixed build in Microsoft's security update guide, which the sources do not name.\n- Confirm Windows Update has installed the latest cumulative update for the machine.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Only machines running affected Windows versions where an attacker already has a local account or code execution. The sources do not state which Windows builds are affected or which update fixes it. Servers and workstations with untrusted local users are the priority to check.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4480,"output_tokens":506,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-121673 to get affected builds and the fixed update.","search":"'-121673':17A,20A '-2026':16A,19A 'access':44B 'allow':73C 'alreadi':41B 'attack':52B,76C 'author':75C 'bug':30B 'code':56B 'corrupt':45B 'cve':15A,18A 'driver':36B 'elev':48B,78C 'filter':2A,22B,34B,71C 'filter-manag':21B 'free':7A,68C 'gain':12A,61B 'higher':13A 'infrastructur':24B 'let':8A,37B 'level':64B 'local':10A,43B,80C 'machin':59B 'manag':3A,23B,35B,72C 'memori':28B,46B 'memory-safeti':27B 'privileg':14A,50B,79C 'right':65B 'run':55B 'safeti':29B 'system':63B 'system-level':62B 'use':5A,66C 'use-after-fre':4A 'user':11A,39B 'window':1A,25B,33B,70C","nicknames":[],"mitigations":[],"who_affected":"Only machines running affected Windows versions where an attacker already has a local account or code execution. The sources do not state which Windows builds are affected or which update fixes it. Servers and workstations with untrusted local users are the priority to check.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["filtermanager","high","infrastructure","windows"],"campaign_type":null,"search_a":"'-121673':17A,20A '-2026':16A,19A 'cve':15A,18A 'filter':2A 'free':7A 'gain':12A 'higher':13A 'let':8A 'local':10A 'manag':3A 'privileg':14A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A","search_b":"'access':44B 'alreadi':41B 'attack':52B 'bug':30B 'code':56B 'corrupt':45B 'driver':36B 'elev':48B 'filter':22B,34B 'filter-manag':21B 'gain':61B 'infrastructur':24B 'let':37B 'level':64B 'local':43B 'machin':59B 'manag':23B,35B 'memori':28B,46B 'memory-safeti':27B 'privileg':50B 'right':65B 'run':55B 'safeti':29B 'system':63B 'system-level':62B 'user':39B 'window':25B,33B","search_c":"'allow':73C 'attack':76C 'author':75C 'elev':78C 'filter':71C 'free':68C 'local':80C 'manag':72C 'privileg':79C 'use':66C 'window':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121673","severity":null,"published_at":"2026-11-10T19:20:30+00:00","modified_at":"2026-11-10T19:20:31+00:00","first_seen_at":"2026-11-10T19:25:09+00:00","fetched_at":"2026-11-10T19:25:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}