{"id":"CVE-2026-95876","kind":"vulnerability","aliases":["CVE-2026-95876"],"related":[],"title":"Windows Local Session Manager: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Local Session Manager (LSM) allows an authorized attacker to elevate privileges locally.","summary":"Windows Local Session Manager has a use-after-free memory bug. An attacker who already has a local account can use it to elevate their privileges on the machine.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","terminal-server","windows","windows-server"],"not_affected_if":["no-local-users"],"how_to_check":"- Check the Windows build with `winver` and compare it against Microsoft's security update guide for CVE-2026-95876\n- Confirm whether the machine has the latest cumulative Windows update installed via Settings > Windows Update","fix":null,"status":"open","published_at":"2026-11-10T19:21:40+00:00","first_seen_at":"2026-11-10T19:25:22+00:00","triaged_at":"2026-11-10T19:49:54+00:00","updated_at":"2026-11-10T19:49:54+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:49:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Local Session Manager: use-after-free lets a local user gain higher privileges","impact":"high","summary":"Windows Local Session Manager has a use-after-free memory bug. An attacker who already has a local account can use it to elevate their privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-server","terminal-server"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the affected Windows builds and the fixed KB from Microsoft's security update guide entry for CVE-2026-95876.","how_to_check":"- Check the Windows build with `winver` and compare it against Microsoft's security update guide for CVE-2026-95876\n- Confirm whether the machine has the latest cumulative Windows update installed via Settings > Windows Update","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Any Windows machine where an authorized user can log on locally, including shared terminal servers and multi-user hosts. The sources do not list affected Windows builds or the fixed update, so check the vendor advisory for this CVE. Machines where only trusted administrators log on are lower risk but still need patching.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4492,"output_tokens":513,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and the fixed KB from Microsoft's security update guide entry for CVE-2026-95876.","search":"'-2026':17A,20A '-95876':18A,21A 'account':49B 'allow':69C 'alreadi':45B 'attack':43B,72C 'author':71C 'bug':41B 'cve':16A,19A 'elev':54B,74C 'free':8A,39B,62C 'gain':13A 'higher':14A 'infrastructur':22B 'let':9A 'local':2A,11A,31B,48B,65C,76C 'lsm':68C 'machin':59B 'manag':4A,33B,67C 'memori':40B 'privileg':15A,56B,75C 'server':25B,29B 'session':3A,32B,66C 'termin':24B 'terminal-serv':23B 'use':6A,37B,51B,60C 'use-after-fre':5A,36B 'user':12A 'window':1A,26B,28B,30B,64C 'windows-serv':27B","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine where an authorized user can log on locally, including shared terminal servers and multi-user hosts. The sources do not list affected Windows builds or the fixed update, so check the vendor advisory for this CVE. Machines where only trusted administrators log on are lower risk but still need patching.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","terminalserver","windows","windowsserver"],"campaign_type":null,"search_a":"'-2026':17A,20A '-95876':18A,21A 'cve':16A,19A 'free':8A 'gain':13A 'higher':14A 'let':9A 'local':2A,11A 'manag':4A 'privileg':15A 'session':3A 'use':6A 'use-after-fre':5A 'user':12A 'window':1A","search_b":"'account':49B 'alreadi':45B 'attack':43B 'bug':41B 'elev':54B 'free':39B 'infrastructur':22B 'local':31B,48B 'machin':59B 'manag':33B 'memori':40B 'privileg':56B 'server':25B,29B 'session':32B 'termin':24B 'terminal-serv':23B 'use':37B,51B 'use-after-fre':36B 'window':26B,28B,30B 'windows-serv':27B","search_c":"'allow':69C 'attack':72C 'author':71C 'elev':74C 'free':62C 'local':65C,76C 'lsm':68C 'manag':67C 'privileg':75C 'session':66C 'use':60C 'window':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95876","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95876","severity":null,"published_at":"2026-11-10T19:21:40+00:00","modified_at":"2026-11-10T19:21:40+00:00","first_seen_at":"2026-11-10T19:25:22+00:00","fetched_at":"2026-11-10T19:25:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}