{"id":"CVE-2026-95934","kind":"vulnerability","aliases":["CVE-2026-95934"],"related":[],"title":"Windows: Diagnostic Policy Service double free lets local users gain admin rights","description":"Double free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.","summary":"Microsoft's November 2026 Patch Tuesday entry rates this Important (CVSS 7.8, local, low privileges, no user interaction). A double free (CWE-415) in the Windows Diagnostic Policy Service lets an attacker who already runs code on the machine as a low-privileged user gain SYSTEM. Microsoft says it is not publicly disclosed and not exploited, and rates exploitation Less Likely. Affected: any Windows machine where an attacker can already run code as a normal user (shared workstations, terminal or build servers, a laptop after a first-stage compromise). It is not remotely reachable by itself. The MSRC data I could read does not list affected builds.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","patch-tuesday","windows"],"not_affected_if":["no-local-access","no-local-untrusted-users"],"how_to_check":"Run winver (or Get-ComputerInfo) and compare the build with the November 2026 cumulative update for your Windows version in the Security Update Guide entry for CVE-2026-95934. The MSRC data I could read gave no build list, so the exact fixed build numbers are unknown. sc query DPS shows whether the service runs, but it is on by default and is not a reliable exposure test.","fix":"Install the November 2026 (released 2026-11-10) Windows security update for your version. MSRC marks customer action as required. Exact KB and fixed build numbers per version were not read; check the Security Update Guide.","status":"open","published_at":"2026-11-10T19:21:46+00:00","first_seen_at":"2026-11-10T19:25:24+00:00","triaged_at":"2026-11-10T19:38:14+00:00","updated_at":"2026-11-10T20:24:17+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: Diagnostic Policy Service double free lets local users gain admin rights","impact":"high","summary":"A memory bug (double free) in the Windows Diagnostic Policy Service lets an attacker who already has a local account raise their privileges. The sources give no further detail on the exploit path.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local attacker gains elevated system privileges on the Windows machine.","analyst_note":"Find the affected Windows builds and the Microsoft patch from the MSRC entry for CVE-2026-95934; the NVD record gives no version ranges.","how_to_check":"- Check the Windows build with `winver` and compare it against Microsoft's security update guide for CVE-2026-95934\n- Confirm the Diagnostic Policy Service (`DPS`) is running with `sc query DPS`","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Windows machines where a user or process already has a local account, since the flaw needs an authorized attacker on the machine. The sources do not name affected Windows builds or say whether the service must be enabled, so the team should confirm against Microsoft's advisory.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4488,"output_tokens":514,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and the Microsoft patch from the MSRC entry for CVE-2026-95934; the NVD record gives no version ranges.","search":"'-2026':14A,17A '-415':50B '-95934':15A,18A '2026':31B '7.8':39B 'admin':11A 'affect':90B,135B 'allow':144C 'alreadi':61B,98B 'attack':59B,96B,147C 'author':146C 'build':109B,136B 'code':63B,100B 'compromis':118B 'could':130B 'cve':13A,16A 'cvss':38B 'cwe':49B 'data':128B 'diagnost':2A,54B,141C 'disclos':81B 'doubl':5A,47B,137C 'elev':149C 'entri':34B 'escal':23B 'exploit':84B,87B 'first':116B 'first-stag':115B 'free':6A,48B,138C 'gain':10A,73B 'import':37B 'infrastructur':19B 'interact':45B 'laptop':112B 'less':88B 'let':7A,57B 'like':89B 'list':134B 'local':8A,21B,40B,151C 'local-privilege-escal':20B 'low':41B,70B 'low-privileg':69B 'machin':66B,93B 'microsoft':28B,75B 'msrc':127B 'normal':103B 'novemb':30B 'patch':25B,32B 'patch-tuesday':24B 'polici':3A,55B,142C 'privileg':22B,42B,71B,150C 'public':80B 'rate':35B,86B 'reachabl':123B 'read':131B 'remot':122B 'right':12A 'run':62B,99B 'say':76B 'server':110B 'servic':4A,56B,143C 'share':105B 'stage':117B 'system':74B 'termin':107B 'tuesday':26B,33B 'user':9A,44B,72B,104B 'window':1A,27B,53B,92B,140C 'workstat':106B","nicknames":[],"mitigations":[],"who_affected":"Windows machines where a user or process already has a local account, since the flaw needs an authorized attacker on the machine. The sources do not name affected Windows builds or say whether the service must be enabled, so the team should confirm against Microsoft's advisory.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","patchtuesday","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-95934':15A,18A 'admin':11A 'cve':13A,16A 'diagnost':2A 'doubl':5A 'free':6A 'gain':10A 'let':7A 'local':8A 'polici':3A 'right':12A 'servic':4A 'user':9A 'window':1A","search_b":"'-415':50B '2026':31B '7.8':39B 'affect':90B,135B 'alreadi':61B,98B 'attack':59B,96B 'build':109B,136B 'code':63B,100B 'compromis':118B 'could':130B 'cvss':38B 'cwe':49B 'data':128B 'diagnost':54B 'disclos':81B 'doubl':47B 'entri':34B 'escal':23B 'exploit':84B,87B 'first':116B 'first-stag':115B 'free':48B 'gain':73B 'import':37B 'infrastructur':19B 'interact':45B 'laptop':112B 'less':88B 'let':57B 'like':89B 'list':134B 'local':21B,40B 'local-privilege-escal':20B 'low':41B,70B 'low-privileg':69B 'machin':66B,93B 'microsoft':28B,75B 'msrc':127B 'normal':103B 'novemb':30B 'patch':25B,32B 'patch-tuesday':24B 'polici':55B 'privileg':22B,42B,71B 'public':80B 'rate':35B,86B 'reachabl':123B 'read':131B 'remot':122B 'run':62B,99B 'say':76B 'server':110B 'servic':56B 'share':105B 'stage':117B 'system':74B 'termin':107B 'tuesday':26B,33B 'user':44B,72B,104B 'window':27B,53B,92B 'workstat':106B","search_c":"'allow':144C 'attack':147C 'author':146C 'diagnost':141C 'doubl':137C 'elev':149C 'free':138C 'local':151C 'polici':142C 'privileg':150C 'servic':143C 'window':140C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95934","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95934","severity":null,"published_at":"2026-11-10T19:21:46+00:00","modified_at":"2026-11-10T19:21:46+00:00","first_seen_at":"2026-11-10T19:25:24+00:00","fetched_at":"2026-11-10T19:25:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95934:2651","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95934","severity":null,"published_at":"2026-11-10T20:24:17+00:00","modified_at":"2026-11-10T20:24:17+00:00","first_seen_at":"2026-11-10T20:24:17+00:00","fetched_at":"2026-11-10T20:24:17+00:00","note":"Read MSRC SUG API JSON for the CVE (primary): EoP, CVSS 7.8, not exploited, not disclosed. Per-product build list and KBs not retrievable (MSRC page is JS-only, CVRF fetch empty); nothing marked verified. No product rows written. X search not attempted.","cites":["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95934"]}],"documents":[{"id":118016,"url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95934","title":"MSRC: CVE-2026-95934 Windows Diagnostic Policy Service Elevation of Privilege Vulnerability","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}