{"id":"CVE-2026-88244","kind":"vulnerability","aliases":["CVE-2026-88244"],"related":[],"title":"Windows: use-after-free in link-layer discovery lets a neighbor run code","description":"Use after free in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over an adjacent network.","summary":"A use-after-free bug in the Windows Link Layer Topology Discovery (LLTD) protocol handling lets an unauthorized attacker run code on the affected machine. The attacker must be on the same network segment (adjacent network).","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Link Layer Topology Discovery","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adjacent-network","infrastructure","lltd","windows"],"not_affected_if":["isolated-network"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:33+00:00","first_seen_at":"2026-11-10T19:25:20+00:00","triaged_at":"2026-11-10T19:42:55+00:00","updated_at":"2026-11-10T19:42:55+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:42:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows: use-after-free in link-layer discovery lets a neighbor run code","impact":"high","summary":"A use-after-free bug in the Windows Link Layer Topology Discovery (LLTD) protocol handling lets an unauthorized attacker run code on the affected machine. The attacker must be on the same network segment (adjacent network).","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","lltd","adjacent-network"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs code on Windows host from adjacent network","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-88244 for affected Windows builds, the fixed update, and whether LLTD is disabled by default.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Link Layer Topology Discovery","needs_analyst":true,"not_affected_if":["isolated-network"],"who_is_affected":"Windows machines with LLTD active on an adjacent network segment are the exposed systems; the sources do not say which Windows versions or default settings are affected. Machines on networks with no untrusted neighbors are lower risk, but the sources do not say more.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4502,"output_tokens":501,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-88244 for affected Windows builds, the fixed update, and whether LLTD is disabled by default.","search":"'-2026':17A,20A '-88244':18A,21A 'adjac':28B,68B,89C 'adjacent-network':27B 'affect':57B 'allow':80C 'attack':52B,60B,83C 'bug':38B 'code':15A,54B,86C 'cve':16A,19A 'discoveri':10A,45B,78C 'discovery':26A 'execut':85C 'free':5A,37B,72C 'handl':48B 'infrastructur':30B 'layer':9A,24A,43B,76C 'let':11A,49B 'link':8A,23A,42B,75C 'link-lay':7A 'lltd':31B,46B 'machin':58B 'must':61B 'neighbor':13A 'network':29B,66B,69B,90C 'protocol':47B,79C 'run':14A,53B 'segment':67B 'topolog':44B,77C 'topology':25A 'unauthor':51B,82C 'use':3A,35B,70C 'use-after-fre':2A,34B 'window':1A,32B,41B,74C 'windows':22A","nicknames":[],"mitigations":[],"who_affected":"Windows machines with LLTD active on an adjacent network segment are the exposed systems; the sources do not say which Windows versions or default settings are affected. Machines on networks with no untrusted neighbors are lower risk, but the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["linklayertopologydiscovery","windowslinklayertopologydiscovery"],"ptokens":["discovery","layer","link","topology","windows"],"labels":["adjacentnetwork","high","infrastructure","lltd","vendor","windows"],"campaign_type":null,"search_a":"'-2026':17A,20A '-88244':18A,21A 'code':15A 'cve':16A,19A 'discoveri':10A 'discovery':26A 'free':5A 'layer':9A,24A 'let':11A 'link':8A,23A 'link-lay':7A 'neighbor':13A 'run':14A 'topology':25A 'use':3A 'use-after-fre':2A 'window':1A 'windows':22A","search_b":"'adjac':28B,68B 'adjacent-network':27B 'affect':57B 'attack':52B,60B 'bug':38B 'code':54B 'discoveri':45B 'free':37B 'handl':48B 'infrastructur':30B 'layer':43B 'let':49B 'link':42B 'lltd':31B,46B 'machin':58B 'must':61B 'network':29B,66B,69B 'protocol':47B 'run':53B 'segment':67B 'topolog':44B 'unauthor':51B 'use':35B 'use-after-fre':34B 'window':32B,41B","search_c":"'adjac':89C 'allow':80C 'attack':83C 'code':86C 'discoveri':78C 'execut':85C 'free':72C 'layer':76C 'link':75C 'network':90C 'protocol':79C 'topolog':77C 'unauthor':82C 'use':70C 'window':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88244","severity":null,"published_at":"2026-11-10T19:21:33+00:00","modified_at":"2026-11-10T19:21:34+00:00","first_seen_at":"2026-11-10T19:25:20+00:00","fetched_at":"2026-11-10T19:25:20+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}