{"id":"CVE-2026-95896","kind":"vulnerability","aliases":["CVE-2026-95896"],"related":[],"title":"Windows DirectMusic: heap overflow lets a local user run code","description":"Heap-based buffer overflow in Windows Microsoft DirectMusic allows an authorized attacker to execute code locally.","summary":"A heap-based buffer overflow in Microsoft DirectMusic on Windows lets an authorized local user corrupt memory. The sources say this can allow the attacker to execute code on the machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft DirectMusic","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["directmusic","local","other","privilege-required","windows"],"not_affected_if":[],"how_to_check":"Run 'winver' or PowerShell Get-ComputerInfo and compare the full build (10.0.<build>.<revision>) with the fixed builds; any build below the fixed revision for its Windows version is affected. Confirm against the MSRC entry.","fix":"Install the November 2026 Windows cumulative update bringing the OS to at least the fixed build for your version (e.g. Windows 11 24H2 10.0.26100.9974, Windows 11 23H2 10.0.22631.7711, Windows 10 22H2 10.0.19045.7846, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822).","status":"open","published_at":"2026-11-10T19:21:43+00:00","first_seen_at":"2026-11-10T19:25:23+00:00","triaged_at":"2026-11-10T19:38:20+00:00","updated_at":"2026-11-10T20:28:29+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T19:38:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows DirectMusic: heap overflow lets a local user run code","impact":"high","summary":"A heap-based buffer overflow in Microsoft DirectMusic on Windows lets an authorized local user corrupt memory. The sources say this can allow the attacker to execute code on the machine.","audience":"businesses","category":"other","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local user runs code with the privileges of the affected process","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95896 for affected Windows builds and the patch; the NVD record gives no version data.","how_to_check":"unknown","plain_action":"","product_name":"Microsoft DirectMusic","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines with DirectMusic present; the sources describe a local attacker who already has an authorized account on the machine and do not name affected Windows builds. unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000664,"input_tokens":4498,"output_tokens":428,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95896 for affected Windows builds and the patch; the NVD record gives no version data.","search":"'-2026':12A,15A '-95896':13A,16A '10':29A '11':20A,23A,26A '2022':33A '2025':36A '22h2':30A '23h2':27A '24h2':21A '25h2':24A 'allow':67B,85C 'attack':69B,88C 'author':57B,87C 'base':47B,78C 'buffer':48B,79C 'code':10A,72B,91C 'corrupt':60B 'cve':11A,14A 'directmus':2A,37B,52B,84C 'directmusic':18A 'execut':71B,90C 'heap':3A,46B,77C 'heap-bas':45B,76C 'let':5A,55B 'local':7A,38B,58B,92C 'machin':75B 'memori':61B 'microsoft':17A,51B,83C 'overflow':4A,49B,80C 'privileg':41B 'privilege-requir':40B 'requir':42B 'run':9A 'say':64B 'server':32A,35A 'sourc':63B 'user':8A,59B 'window':1A,43B,54B,82C 'windows':19A,22A,25A,28A,31A,34A","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10, Windows 11 or Windows Server 2016-2025 machine below the fixed build is affected. Exploitation needs local access with low privileges, so shared machines, RDP/terminal servers, VDI and developer or CI Windows hosts matter most. Single-user machines with no untrusted local code are lower risk but should still patch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["1022h2","1123h2","1124h2","1125h2","directmusic","microsoftdirectmusic","server2022","server2025","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","2022","2025","22h2","23h2","24h2","25h2","directmusic","microsoft","server","windows"],"labels":["directmusic","high","local","other","privilegerequired","vendor","windows"],"campaign_type":null,"search_a":"'-2026':12A,15A '-95896':13A,16A '10':29A '11':20A,23A,26A '2022':33A '2025':36A '22h2':30A '23h2':27A '24h2':21A '25h2':24A 'code':10A 'cve':11A,14A 'directmus':2A 'directmusic':18A 'heap':3A 'let':5A 'local':7A 'microsoft':17A 'overflow':4A 'run':9A 'server':32A,35A 'user':8A 'window':1A 'windows':19A,22A,25A,28A,31A,34A","search_b":"'allow':67B 'attack':69B 'author':57B 'base':47B 'buffer':48B 'code':72B 'corrupt':60B 'directmus':37B,52B 'execut':71B 'heap':46B 'heap-bas':45B 'let':55B 'local':38B,58B 'machin':75B 'memori':61B 'microsoft':51B 'overflow':49B 'privileg':41B 'privilege-requir':40B 'requir':42B 'say':64B 'sourc':63B 'user':59B 'window':43B,54B","search_c":"'allow':85C 'attack':88C 'author':87C 'base':78C 'buffer':79C 'code':91C 'directmus':84C 'execut':90C 'heap':77C 'heap-bas':76C 'local':92C 'microsoft':83C 'overflow':80C 'window':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95896","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95896","severity":null,"published_at":"2026-11-10T19:21:43+00:00","modified_at":"2026-11-10T19:21:43+00:00","first_seen_at":"2026-11-10T19:25:23+00:00","fetched_at":"2026-11-10T19:25:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95896:2661","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95896","severity":null,"published_at":"2026-11-10T20:28:29+00:00","modified_at":"2026-11-10T20:28:29+00:00","first_seen_at":"2026-11-10T20:28:29+00:00","fetched_at":"2026-11-10T20:28:29+00:00","note":"NVD page carries Microsoft CNA affected builds (contrary to triage). MSRC page is JS-only and did not render, so nothing marked verified; no exploitation or PoC seen, social not searched.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-95896","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95896"]}],"documents":[{"id":118028,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95896","title":"NVD CVE-2026-95896 (Microsoft CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":118029,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95896","title":"MSRC Security Update Guide CVE-2026-95896 (JS-only, did not render)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}