---
id: "CVE-2026-95896"
page: "https://infrastack.ai/live/CVE-2026-95896"
kind: "vulnerability"
aliases: ["CVE-2026-95896"]
title: "Windows DirectMusic: heap overflow lets a local user run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Microsoft DirectMusic", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": "< 10.0.26100.9974", "ecosystem": "vendor"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9974"], "affected": "< 10.0.26200.9974", "ecosystem": "vendor"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": "< 10.0.22631.7711", "ecosystem": "vendor"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": "< 10.0.19045.7846", "ecosystem": "vendor"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": "< 10.0.20348.5870", "ecosystem": "vendor"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": "< 10.0.26100.33822", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["directmusic", "local", "other", "privilege-required", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:21:43+00:00"
first_seen_at: "2026-11-10T19:25:23+00:00"
updated_at: "2026-11-10T20:28:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95896", "first_seen_at": "2026-11-10T19:25:23+00:00"}, {"source": "analyst", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95896", "first_seen_at": "2026-11-10T20:28:29+00:00", "cites": ["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95896", "https://nvd.nist.gov/vuln/detail/CVE-2026-95896"]}]
exploit_sources: []
---

# Windows DirectMusic: heap overflow lets a local user run code

Link for people: https://infrastack.ai/live/CVE-2026-95896 (this .md is for agents)

A heap-based buffer overflow in Microsoft DirectMusic on Windows lets an authorized local user corrupt memory. The sources say this can allow the attacker to execute code on the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft DirectMusic affected range not listed fixed no fixed version listed
- vendor:Windows 11 24H2 affected < 10.0.26100.9974 fixed 10.0.26100.9974
- vendor:Windows 11 25H2 affected < 10.0.26200.9974 fixed 10.0.26200.9974
- vendor:Windows 11 23H2 affected < 10.0.22631.7711 fixed 10.0.22631.7711
- vendor:Windows 10 22H2 affected < 10.0.19045.7846 fixed 10.0.19045.7846
- vendor:Windows Server 2022 affected < 10.0.20348.5870 fixed 10.0.20348.5870
- vendor:Windows Server 2025 affected < 10.0.26100.33822 fixed 10.0.26100.33822

## How to check

Run 'winver' or PowerShell Get-ComputerInfo and compare the full build (10.0.<build>.<revision>) with the fixed builds; any build below the fixed revision for its Windows version is affected. Confirm against the MSRC entry.

## Fix

Install the November 2026 Windows cumulative update bringing the OS to at least the fixed build for your version (e.g. Windows 11 24H2 10.0.26100.9974, Windows 11 23H2 10.0.22631.7711, Windows 10 22H2 10.0.19045.7846, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822).

## Timeline

- 2026-11-10T19:25:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95896
- 2026-11-10T20:28:29+00:00 analyst https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95896 — NVD page carries Microsoft CNA affected builds (contrary to triage). MSRC page is JS-only and did not render, so nothing marked verified; no exploitation or PoC seen, social not searched.

## Documents

- [advisory] MSRC Security Update Guide CVE-2026-95896 (JS-only, did not render) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95896
- [describes] NVD CVE-2026-95896 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/CVE-2026-95896

## From the sources

Heap-based buffer overflow in Windows Microsoft DirectMusic allows an authorized attacker to execute code locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_