{"id":"CVE-2026-95891","kind":"vulnerability","aliases":["CVE-2026-95891"],"related":[],"title":"Windows DirectMusic: heap overflow lets a local user run code","description":"Heap-based buffer overflow in Windows Microsoft DirectMusic allows an authorized attacker to execute code locally.","summary":"A heap-based buffer overflow in Microsoft DirectMusic on Windows lets an attacker who already has a local, authorized account run code. The sources give no more detail on the trigger or the affected Windows builds.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["directmusic","other","windows"],"not_affected_if":[],"how_to_check":"Unknown. Open the MSRC Security Update Guide entry for CVE-2026-95891 for affected Windows builds and the KB; the November 2026 Patch Tuesday cumulative update (released 2026-11-10) is the likely carrier but this is unconfirmed. Check installed KBs with Get-HotFix.","fix":null,"status":"open","published_at":"2026-11-10T19:21:42+00:00","first_seen_at":"2026-11-10T19:25:22+00:00","triaged_at":"2026-11-10T19:38:23+00:00","updated_at":"2026-11-10T20:28:31+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T19:38:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows DirectMusic: heap overflow lets a local user run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft DirectMusic on Windows lets an attacker who already has a local, authorized account run code. The sources give no more detail on the trigger or the affected Windows builds.","audience":"businesses","category":"other","nicknames":[],"who_cares":["windows","directmusic"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user runs code with elevated privileges on Windows","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-95891 for affected Windows builds, patch KB and whether the flaw is default-on.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines where a user already has a local account can be exposed to code execution through DirectMusic. The sources do not list affected Windows builds or whether the component is on by default. Machines reachable only by trusted, single-user accounts carry less risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000668,"input_tokens":4498,"output_tokens":437,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-95891 for affected Windows builds, patch KB and whether the flaw is default-on.","search":"'-2026':12A,15A '-95891':13A,16A 'account':40B 'affect':54B 'allow':66C 'alreadi':35B 'attack':33B,69C 'author':39B,68C 'base':23B,59C 'buffer':24B,60C 'build':56B 'code':10A,42B,72C 'cve':11A,14A 'detail':48B 'directmus':2A,17B,28B,65C 'execut':71C 'give':45B 'heap':3A,22B,58C 'heap-bas':21B,57C 'let':5A,31B 'local':7A,38B,73C 'microsoft':27B,64C 'overflow':4A,25B,61C 'run':9A,41B 'sourc':44B 'trigger':51B 'user':8A 'window':1A,19B,30B,55B,63C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where a user already has a local account can be exposed to code execution through DirectMusic. The sources do not list affected Windows builds or whether the component is on by default. Machines reachable only by trusted, single-user accounts carry less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["directmusic","high","other","windows"],"campaign_type":null,"search_a":"'-2026':12A,15A '-95891':13A,16A 'code':10A 'cve':11A,14A 'directmus':2A 'heap':3A 'let':5A 'local':7A 'overflow':4A 'run':9A 'user':8A 'window':1A","search_b":"'account':40B 'affect':54B 'alreadi':35B 'attack':33B 'author':39B 'base':23B 'buffer':24B 'build':56B 'code':42B 'detail':48B 'directmus':17B,28B 'give':45B 'heap':22B 'heap-bas':21B 'let':31B 'local':38B 'microsoft':27B 'overflow':25B 'run':41B 'sourc':44B 'trigger':51B 'window':19B,30B,55B","search_c":"'allow':66C 'attack':69C 'author':68C 'base':59C 'buffer':60C 'code':72C 'directmus':65C 'execut':71C 'heap':58C 'heap-bas':57C 'local':73C 'microsoft':64C 'overflow':61C 'window':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95891","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95891","severity":null,"published_at":"2026-11-10T19:21:42+00:00","modified_at":"2026-11-10T19:21:42+00:00","first_seen_at":"2026-11-10T19:25:22+00:00","fetched_at":"2026-11-10T19:25:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95891:2664","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95891","severity":null,"published_at":"2026-11-10T20:28:31+00:00","modified_at":"2026-11-10T20:28:31+00:00","first_seen_at":"2026-11-10T20:28:31+00:00","fetched_at":"2026-11-10T20:28:31+00:00","note":"MSRC page is JS-only and returned nothing; CVRF 2026-Nov feed too large (>10MB) to fetch; NVD gives only the description and CVSS 7.8 (AV:L/PR:L). No affected builds, KB, or default-on status confirmed; nothing verified. Search tools not used beyond this. Needs a revisit with the MSRC page text or a smaller CVRF query.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-95891"]}],"documents":[{"id":118031,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95891","title":"NVD CVE-2026-95891","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}