{"id":"CVE-2026-95881","kind":"vulnerability","aliases":["CVE-2026-95881"],"related":[],"title":"Windows Push Notifications: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in Windows Push Notifications lets a user with a local account elevate privileges (CVSS 7.8, AV:L/PR:L). Microsoft listed it in the November 2026 Patch Tuesday. No exploitation or public PoC found.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"Open the Microsoft Security Update Guide entry for CVE-2026-95881, find the KB for your Windows build, and compare with the installed hotfixes (PowerShell: Get-HotFix). Affected builds and KB numbers are unknown until read from MSRC.","fix":null,"status":"open","published_at":"2026-11-10T19:21:41+00:00","first_seen_at":"2026-11-10T19:25:22+00:00","triaged_at":"2026-11-10T19:38:24+00:00","updated_at":"2026-11-10T20:30:20+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:38:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Push Notifications: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Push Notifications component lets an authorized local user corrupt memory. An attacker who already has a foothold on the machine can use it to elevate privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","local-privilege-escalation"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95881 for affected Windows builds, the patch KB, and whether it is fixed.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Only machines running Windows with the Push Notifications component are in scope, and the attacker must already have a local account. Exposure is limited to local logins on those hosts; the sources do not say which Windows builds are affected. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000671,"input_tokens":4494,"output_tokens":444,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95881 for affected Windows builds, the patch KB, and whether it is fixed.","search":"'-2026':14A,17A '-95881':15A,18A '2026':55B '7.8':45B 'account':41B 'allow':73C 'attack':76C 'author':75C 'av':46B 'base':28B,66C 'buffer':29B,67C 'cve':13A,16A 'cvss':44B 'elev':42B,78C 'escal':23B 'exploit':59B 'found':63B 'gain':10A 'heap':4A,27B,65C 'heap-bas':26B,64C 'higher':11A 'infrastructur':19B 'l':48B 'l/pr':47B 'let':6A,35B 'list':50B 'local':8A,21B,40B,80C 'local-privilege-escal':20B 'microsoft':49B 'notif':3A,34B,72C 'novemb':54B 'overflow':5A,30B,68C 'patch':56B 'poc':62B 'privileg':12A,22B,43B,79C 'public':61B 'push':2A,33B,71C 'tuesday':57B 'user':9A,37B 'window':1A,24B,32B,70C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where an attacker already has a local low-privilege account or code execution. Servers and workstations with shared or untrusted local users, such as RDP hosts, CI runners and shared desktops, matter most. The exact affected builds are not confirmed from Microsoft's page. Single-user machines with no untrusted code are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-95881':15A,18A 'cve':13A,16A 'gain':10A 'heap':4A 'higher':11A 'let':6A 'local':8A 'notif':3A 'overflow':5A 'privileg':12A 'push':2A 'user':9A 'window':1A","search_b":"'2026':55B '7.8':45B 'account':41B 'av':46B 'base':28B 'buffer':29B 'cvss':44B 'elev':42B 'escal':23B 'exploit':59B 'found':63B 'heap':27B 'heap-bas':26B 'infrastructur':19B 'l':48B 'l/pr':47B 'let':35B 'list':50B 'local':21B,40B 'local-privilege-escal':20B 'microsoft':49B 'notif':34B 'novemb':54B 'overflow':30B 'patch':56B 'poc':62B 'privileg':22B,43B 'public':61B 'push':33B 'tuesday':57B 'user':37B 'window':24B,32B","search_c":"'allow':73C 'attack':76C 'author':75C 'base':66C 'buffer':67C 'elev':78C 'heap':65C 'heap-bas':64C 'local':80C 'notif':72C 'overflow':68C 'privileg':79C 'push':71C 'window':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95881","severity":null,"published_at":"2026-11-10T19:21:41+00:00","modified_at":"2026-11-10T19:21:41+00:00","first_seen_at":"2026-11-10T19:25:22+00:00","fetched_at":"2026-11-10T19:25:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95881:2667","url":null,"severity":null,"published_at":"2026-11-10T20:30:20+00:00","modified_at":"2026-11-10T20:30:20+00:00","first_seen_at":"2026-11-10T20:30:20+00:00","fetched_at":"2026-11-10T20:30:20+00:00","note":"MSRC Update Guide page is JS-only and the CVRF API returned no entry text, so affected builds and KB could not be read from the vendor. Release is in the November 2026 Patch Tuesday (2026-11-10); a secondary aggregator suggests Windows 10/11 builds but I did not verify. Nothing marked verified."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}