---
id: "CVE-2026-88244"
page: "https://infrastack.ai/live/CVE-2026-88244"
kind: "vulnerability"
aliases: ["CVE-2026-88244"]
title: "Windows: use-after-free in link-layer discovery lets a neighbor run code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Link Layer Topology Discovery", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adjacent-network", "infrastructure", "lltd", "windows"]
not_affected_if: ["isolated-network"]
published_at: "2026-11-10T19:21:33+00:00"
first_seen_at: "2026-11-10T19:25:20+00:00"
updated_at: "2026-11-10T20:39:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88244", "first_seen_at": "2026-11-10T19:25:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T20:39:51+00:00"}]
exploit_sources: []
---

# Windows: use-after-free in link-layer discovery lets a neighbor run code

Link for people: https://infrastack.ai/live/CVE-2026-88244 (this .md is for agents)

A use-after-free bug in the Windows Link Layer Topology Discovery (LLTD) protocol handling lets an unauthorized attacker run code on the affected machine. The attacker must be on the same network segment (adjacent network).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Link Layer Topology Discovery affected range not listed fixed no fixed version listed

## How to check

Unknown. Check the MSRC Security Update Guide entry for CVE-2026-88244 for affected builds. Confirm the November 2026 cumulative update is installed (Windows Update > Update history). Whether LLTD (Link-Layer Topology Discovery) is enabled is not confirmed; it is a per-adapter binding (Link-Layer Topology Discovery Mapper/Responder I/O Driver) in adapter properties.

## Timeline

- 2026-11-10T19:25:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88244
- 2026-11-10T20:39:51+00:00 analyst — Could not read the MSRC entry: the page is JS-only, web-cli returned only the title, the CVRF API returned nothing, browser-cli returned 402, and NVD returned no content. Affected builds, fixed KB and LLTD default state are unconfirmed. It is probably in the 2026-11-10 Patch Tuesday (BleepingComputer coverage), but that is not a primary source for this CVE. Nothing verified. Next step: read the MSRC entry for CVE-2026-88244.

## From the sources

Use after free in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over an adjacent network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_