{"id":"CVE-2026-95901","kind":"vulnerability","aliases":["CVE-2026-95901"],"related":[],"title":"Windows DirectMusic: double free lets a network attacker run code","description":"Double free in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.","summary":"A double free bug in the Windows Microsoft DirectMusic component lets an attacker send crafted input over a network and run code. The NVD record gives it a CVSS score of 9.8 and no exploitation has been reported.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","microsoft-directmusic","windows"],"not_affected_if":["unknown"],"how_to_check":"Unknown until Microsoft lists affected builds. Open the MSRC Security Update Guide page for CVE-2026-95901, find the KB for your Windows version, and compare it with the installed build (winver, or Get-HotFix in PowerShell).","fix":null,"status":"open","published_at":"2026-11-10T19:21:43+00:00","first_seen_at":"2026-11-10T19:25:23+00:00","triaged_at":"2026-11-10T19:25:33+00:00","updated_at":"2026-11-10T19:27:21+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:25:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows DirectMusic: double free lets a network attacker run code","impact":"high","summary":"A double free bug in the Windows Microsoft DirectMusic component lets an attacker send crafted input over a network and run code. The NVD record gives it a CVSS score of 9.8 and no exploitation has been reported.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","microsoft-directmusic"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the Windows machine over the network","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-95901 for affected Windows builds, the fixed update and whether user action or special setup is needed.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Any Windows machine with the affected DirectMusic component is potentially exposed to network-triggered code execution. The sources do not name affected Windows builds or whether the component is reachable by default. Teams should apply vendor updates for Windows once Microsoft lists the affected versions.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000681,"input_tokens":4489,"output_tokens":464,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-95901 for affected Windows builds, the fixed update and whether user action or special setup is needed.","search":"'-2026':12A,15A '-95901':13A,16A '9.8':53B 'allow':66C 'attack':8A,34B,69C 'bug':25B 'code':10A,43B,72C 'compon':31B 'craft':36B 'cve':11A,14A 'cvss':50B 'directmus':2A,20B,30B,65C 'doubl':3A,23B,60C 'execut':71C 'exploit':56B 'free':4A,24B,61C 'give':47B 'infrastructur':17B 'input':37B 'let':5A,32B 'microsoft':19B,29B,64C 'microsoft-directmus':18B 'network':7A,40B,75C 'nvd':45B 'record':46B 'report':59B 'run':9A,42B 'score':51B 'send':35B 'unauthor':68C 'window':1A,21B,28B,63C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine with the affected DirectMusic component is potentially exposed to network-triggered code execution. The sources do not name affected Windows builds or whether the component is reachable by default. Teams should apply vendor updates for Windows once Microsoft lists the affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","infrastructure","microsoftdirectmusic","windows"],"campaign_type":null,"search_a":"'-2026':12A,15A '-95901':13A,16A 'attack':8A 'code':10A 'cve':11A,14A 'directmus':2A 'doubl':3A 'free':4A 'let':5A 'network':7A 'run':9A 'window':1A","search_b":"'9.8':53B 'attack':34B 'bug':25B 'code':43B 'compon':31B 'craft':36B 'cvss':50B 'directmus':20B,30B 'doubl':23B 'exploit':56B 'free':24B 'give':47B 'infrastructur':17B 'input':37B 'let':32B 'microsoft':19B,29B 'microsoft-directmus':18B 'network':40B 'nvd':45B 'record':46B 'report':59B 'run':42B 'score':51B 'send':35B 'window':21B,28B","search_c":"'allow':66C 'attack':69C 'code':72C 'directmus':65C 'doubl':60C 'execut':71C 'free':61C 'microsoft':64C 'network':75C 'unauthor':68C 'window':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95901","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95901","severity":null,"published_at":"2026-11-10T19:21:43+00:00","modified_at":"2026-11-10T19:21:43+00:00","first_seen_at":"2026-11-10T19:25:23+00:00","fetched_at":"2026-11-10T19:25:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95901:2505","url":null,"severity":null,"published_at":"2026-11-10T19:27:21+00:00","modified_at":"2026-11-10T19:27:21+00:00","first_seen_at":"2026-11-10T19:27:21+00:00","fetched_at":"2026-11-10T19:27:21+00:00","note":"Could not read the MSRC advisory body (JS page rendered only the title 'Microsoft DirectMusic Remote Code Execution Vulnerability'; web-cli returned nothing; NVD page also empty). Search results only cover sibling CVE-2026-69491 (heap overflow, Sept 2026), not this one. No builds, KB or fix confirmed. Revisit when MSRC/NVD text is indexed; nothing verified."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}