{"id":"CVE-2026-95894","kind":"vulnerability","aliases":["CVE-2026-95894"],"related":[],"title":"Windows Task Scheduler: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Task Scheduler lets an authorized local user elevate their privileges. An attacker who already has a logon on the machine can gain higher rights than they were granted.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 Version 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":">= 10.0.14393.0, < 10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 10 Version 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":">= 10.0.19044.0, < 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">= 10.0.22631.0, < 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":">= 10.0.26100.0, < 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":">= 10.0.26200.0, < 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":">= 10.0.28000.0, < 10.0.28000.3501","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":">= 10.0.26300.0, < 10.0.26300.9974","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":">= 10.0.20348.0, < 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"microsoft"}],"ecosystems":[],"tags":["heap-overflow","infrastructure","local-privilege-escalation","task-scheduler","windows"],"not_affected_if":["no-local-users","patched-build"],"how_to_check":"Run 'winver' or PowerShell '[System.Environment]::OSVersion.Version' and compare the build (10.0.x.y) with the fixed build for your Windows version; lower means exposed.","fix":"Install the November 2026 Windows cumulative update that brings your build to at least the fixed build for your version (e.g. Win 11 24H2 10.0.26100.9974, Win 10 22H2 10.0.19045.7846, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822).","status":"open","published_at":"2026-11-10T19:21:42+00:00","first_seen_at":"2026-11-10T19:25:23+00:00","triaged_at":"2026-11-10T19:38:24+00:00","updated_at":"2026-11-10T20:28:29+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:38:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Task Scheduler: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Task Scheduler lets an authorized local user elevate their privileges. An attacker who already has a logon on the machine can gain higher rights than they were granted.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","task-scheduler"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Confirm affected Windows builds and the Microsoft fixed build from the NVD and Microsoft Security Update Guide entry for CVE-2026-95894.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Affects Windows systems where a user already has a local account and can run code or interact with Task Scheduler. The sources do not list affected Windows versions or a fixed build. Remote attackers without local access are not described as able to trigger it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000673,"input_tokens":4496,"output_tokens":447,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Windows builds and the Microsoft fixed build from the NVD and Microsoft Security Update Guide entry for CVE-2026-95894.","search":"'-2026':14A,17A '-95894':15A,18A '10':20A,26A,32A,35A '11':38A,41A,44A,47A,50A '1607':22A '1809':28A '2016':24A '2019':30A '2022':54A '2025':57A '21h2':33A '22h2':36A '23h2':39A '24h2':42A '25h2':45A '26h1':48A '26h2':51A 'allow':116C 'alreadi':92B 'attack':90B,119C 'author':83B,118C 'base':73B,109C 'buffer':74B,110C 'cve':13A,16A 'elev':86B,121C 'escal':65B 'gain':10A,100B 'grant':106B 'heap':4A,59B,72B,108C 'heap-bas':71B,107C 'heap-overflow':58B 'higher':11A,101B 'infrastructur':61B 'let':6A,81B 'local':8A,63B,84B,123C 'local-privilege-escal':62B 'logon':95B 'machin':98B 'overflow':5A,60B,75B,111C 'privileg':12A,64B,88B,122C 'right':102B 'schedul':3A,68B,80B,115C 'server':23A,29A,53A,56A 'task':2A,67B,79B,114C 'task-schedul':66B 'user':9A,85B 'version':21A,27A 'window':1A,69B,78B,113C 'windows':19A,25A,31A,34A,37A,40A,43A,46A,49A,52A,55A","nicknames":[],"mitigations":[],"who_affected":"Affects Windows systems where a user already has a local account and can run code or interact with Task Scheduler. The sources do not list affected Windows versions or a fixed build. Remote attackers without local access are not described as able to trigger it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["1021h2","1022h2","10version1607server2016","10version1809server2019","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows1021h2","windows1022h2","windows10version1607server2016","windows10version1809server2019","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","version","windows"],"labels":["heapoverflow","high","infrastructure","localprivilegeescalation","taskscheduler","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-95894':15A,18A '10':20A,26A,32A,35A '11':38A,41A,44A,47A,50A '1607':22A '1809':28A '2016':24A '2019':30A '2022':54A '2025':57A '21h2':33A '22h2':36A '23h2':39A '24h2':42A '25h2':45A '26h1':48A '26h2':51A 'cve':13A,16A 'gain':10A 'heap':4A 'higher':11A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'schedul':3A 'server':23A,29A,53A,56A 'task':2A 'user':9A 'version':21A,27A 'window':1A 'windows':19A,25A,31A,34A,37A,40A,43A,46A,49A,52A,55A","search_b":"'alreadi':92B 'attack':90B 'author':83B 'base':73B 'buffer':74B 'elev':86B 'escal':65B 'gain':100B 'grant':106B 'heap':59B,72B 'heap-bas':71B 'heap-overflow':58B 'higher':101B 'infrastructur':61B 'let':81B 'local':63B,84B 'local-privilege-escal':62B 'logon':95B 'machin':98B 'overflow':60B,75B 'privileg':64B,88B 'right':102B 'schedul':68B,80B 'task':67B,79B 'task-schedul':66B 'user':85B 'window':69B,78B","search_c":"'allow':116C 'attack':119C 'author':118C 'base':109C 'buffer':110C 'elev':121C 'heap':108C 'heap-bas':107C 'local':123C 'overflow':111C 'privileg':122C 'schedul':115C 'task':114C 'window':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95894","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95894","severity":null,"published_at":"2026-11-10T19:21:42+00:00","modified_at":"2026-11-10T19:21:42+00:00","first_seen_at":"2026-11-10T19:25:23+00:00","fetched_at":"2026-11-10T19:25:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95894:2663","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95894","severity":null,"published_at":"2026-11-10T20:28:29+00:00","modified_at":"2026-11-10T20:28:29+00:00","first_seen_at":"2026-11-10T20:28:29+00:00","fetched_at":"2026-11-10T20:28:29+00:00","note":"Affected builds and fixed builds taken from NVD (Microsoft CNA data). The MSRC page returned no text, so nothing is marked verified. No exploitation or PoC found in sources read; I did not search social posts.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-95894"]}],"documents":[{"id":118030,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95894","title":"NVD CVE-2026-95894 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}