{"id":"CVE-2026-94531","kind":"vulnerability","aliases":["CVE-2026-94531"],"related":[],"title":"Windows COM: stack buffer overflow lets a local user gain higher privileges","description":"Stack-based buffer overflow in Windows COM allows an authorized attacker to elevate privileges locally.","summary":"Microsoft's CVE record (CWE-121) describes a stack-based buffer overflow in Windows COM that lets an authorized local attacker elevate privileges. CVSS 3.1 is 7.8 (AV:L/PR:L/UI:N). It is not in KEV, and the record marks exploit code maturity as unproven. Fixed builds are listed per Windows version; KB article numbers were not read.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows COM","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["com","infrastructure","local-accounts","privilege-escalation","windows"],"not_affected_if":["patched-build"],"how_to_check":"Run winver or [Environment]::OSVersion / (Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').UBR and compare the build with the fixed builds (e.g. Windows 11 24H2 and 25H2 need 10.0.26100/26200.9974 or later; Server 2022 needs 10.0.20348.5870 or later). Install the November 2026 cumulative update.","fix":"Install the Microsoft November 2026 security update that raises the build to at least the fixed build for your version (listed in the product rows). KB numbers not confirmed.","status":"open","published_at":"2026-11-10T19:21:38+00:00","first_seen_at":"2026-11-10T19:25:21+00:00","triaged_at":"2026-11-10T19:38:29+00:00","updated_at":"2026-11-10T20:34:58+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows COM: stack buffer overflow lets a local user gain higher privileges","impact":"high","summary":"A stack-based buffer overflow in the Windows COM component lets an attacker who already has a local account raise their privileges. The sources give no details beyond that, and the CVSS score is 7.8 (high).","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","local-accounts"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Find the affected Windows builds and the Microsoft update that fixes CVE-2026-94531 at the NVD entry or Microsoft's security update guide.","how_to_check":"- unknown","plain_action":"","product_name":"Windows COM","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines where a user already has a local account are the exposed case; the sources do not say which Windows builds or configurations are affected. unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":4486,"output_tokens":427,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and the Microsoft update that fixes CVE-2026-94531 at the NVD entry or Microsoft's security update guide.","search":"'-121':72B '-2026':14A,17A '-94531':15A,18A '10':22A,27A,32A,35A '11':38A,41A,44A,47A,50A '1607':23A '1809':28A '2016':25A '2019':30A '2022':54A '2025':57A '21h2':33A '22h2':36A '23h2':39A '24h2':42A '25h2':45A '26h1':48A '26h2':51A '3.1':92B '7.8':94B 'account':62B 'allow':134C 'articl':121B 'attack':88B,137C 'author':86B,136C 'av':95B 'base':77B,128C 'buffer':4A,78B,129C 'build':114B 'code':109B 'com':2A,20A,58B,82B,133C 'cve':13A,16A,69B 'cvss':91B 'cwe':71B 'describ':73B 'elev':89B,139C 'escal':65B 'exploit':108B 'fix':113B 'gain':10A 'higher':11A 'infrastructur':59B 'kb':120B 'kev':103B 'l/pr':96B 'l/ui':97B 'let':6A,84B 'list':116B 'local':8A,61B,87B,141C 'local-account':60B 'mark':107B 'matur':110B 'microsoft':67B 'n':98B 'number':122B 'overflow':5A,79B,130C 'per':117B 'privileg':12A,64B,90B,140C 'privilege-escal':63B 'read':125B 'record':70B,106B 'server':24A,29A,53A,56A 'stack':3A,76B,127C 'stack-bas':75B,126C 'unproven':112B 'user':9A 'version':119B 'window':1A,66B,81B,118B,132C 'windows':19A,21A,26A,31A,34A,37A,40A,43A,46A,49A,52A,55A","nicknames":[],"mitigations":[],"who_affected":"Windows machines where a user already has a local account are the exposed case; the sources do not say which Windows builds or configurations are affected. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","com","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowscom","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","com","server","windows"],"labels":["com","high","infrastructure","localaccounts","privilegeescalation","vendor","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-94531':15A,18A '10':22A,27A,32A,35A '11':38A,41A,44A,47A,50A '1607':23A '1809':28A '2016':25A '2019':30A '2022':54A '2025':57A '21h2':33A '22h2':36A '23h2':39A '24h2':42A '25h2':45A '26h1':48A '26h2':51A 'buffer':4A 'com':2A,20A 'cve':13A,16A 'gain':10A 'higher':11A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'server':24A,29A,53A,56A 'stack':3A 'user':9A 'window':1A 'windows':19A,21A,26A,31A,34A,37A,40A,43A,46A,49A,52A,55A","search_b":"'-121':72B '3.1':92B '7.8':94B 'account':62B 'articl':121B 'attack':88B 'author':86B 'av':95B 'base':77B 'buffer':78B 'build':114B 'code':109B 'com':58B,82B 'cve':69B 'cvss':91B 'cwe':71B 'describ':73B 'elev':89B 'escal':65B 'exploit':108B 'fix':113B 'infrastructur':59B 'kb':120B 'kev':103B 'l/pr':96B 'l/ui':97B 'let':84B 'list':116B 'local':61B,87B 'local-account':60B 'mark':107B 'matur':110B 'microsoft':67B 'n':98B 'number':122B 'overflow':79B 'per':117B 'privileg':64B,90B 'privilege-escal':63B 'read':125B 'record':70B,106B 'stack':76B 'stack-bas':75B 'unproven':112B 'version':119B 'window':66B,81B,118B","search_c":"'allow':134C 'attack':137C 'author':136C 'base':128C 'buffer':129C 'com':133C 'elev':139C 'local':141C 'overflow':130C 'privileg':140C 'stack':127C 'stack-bas':126C 'window':132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94531","severity":null,"published_at":"2026-11-10T19:21:38+00:00","modified_at":"2026-11-10T19:21:39+00:00","first_seen_at":"2026-11-10T19:25:21+00:00","fetched_at":"2026-11-10T19:25:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-94531:2675","url":"https://app.opencve.io/cve/CVE-2026-94531","severity":null,"published_at":"2026-11-10T20:34:58+00:00","modified_at":"2026-11-10T20:34:58+00:00","first_seen_at":"2026-11-10T20:34:58+00:00","fetched_at":"2026-11-10T20:34:58+00:00","note":"Microsoft's MSRC page returned no text; affected builds taken from OpenCVE mirror of the Microsoft CVE record (secondary), so nothing verified. KB numbers unknown; settle at the MSRC update guide. No exploitation or PoC found.","cites":["https://app.opencve.io/cve/CVE-2026-94531"]}],"documents":[{"id":118047,"url":"https://app.opencve.io/cve/CVE-2026-94531","title":"OpenCVE: CVE-2026-94531 (mirror of Microsoft CVE record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}