---
id: "CVE-2026-88238"
page: "https://infrastack.ai/live/CVE-2026-88238"
kind: "vulnerability"
aliases: ["CVE-2026-88238"]
title: "Windows: Camera Frame Server Monitor heap overflow lets local users gain privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["endpoints", "infrastructure", "local-privilege-escalation", "windows"]
not_affected_if: ["no-local-untrusted-users"]
published_at: "2026-11-10T19:21:32+00:00"
first_seen_at: "2026-11-10T19:25:20+00:00"
updated_at: "2026-11-10T20:42:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88238", "first_seen_at": "2026-11-10T19:25:20+00:00"}, {"source": "analyst", "url": "https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-88238", "first_seen_at": "2026-11-10T20:42:18+00:00", "cites": ["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-88238"]}]
exploit_sources: []
---

# Windows: Camera Frame Server Monitor heap overflow lets local users gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-88238 (this .md is for agents)

Microsoft's November 2026 update (released 2026-11-10) fixes a heap-based buffer overflow (CWE-122) in the Windows Camera Frame Server Monitor. A local attacker with a low-privilege account can use it to go from Medium Integrity Level to Local Service. Microsoft rates it Important (CVSS 7.8), says it is not publicly disclosed or exploited, and marks it 'Exploitation More Likely'.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Compare your installed Windows cumulative update with the KB listed for CVE-2026-88238 in the Microsoft Security Update Guide (e.g. Get-HotFix, or winver for the build). Machines without the November 2026 update are exposed. Affected builds and KB numbers were not available from the API entry.

## Fix

Install the November 2026 Windows cumulative security update for your Windows version. Microsoft's guide entry (customer action required) as read by the analyst does not list builds or KB numbers; check the Security Update Guide page for your build.

## Timeline

- 2026-11-10T19:25:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88238
- 2026-11-10T20:42:18+00:00 analyst https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-88238 — MSRC API entry read: Important, 7.8, not exploited/disclosed, Exploitation More Likely, MIL->Local Service. No build/KB list in the entry, so fix/products not verified. Web search and X not used.

## Documents

- [advisory] MSRC: CVE-2026-88238 Windows Camera Frame Server Monitor EoP https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-88238

## From the sources

Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_