---
id: "CVE-2026-95934"
page: "https://infrastack.ai/live/CVE-2026-95934"
kind: "vulnerability"
aliases: ["CVE-2026-95934"]
title: "Windows: Diagnostic Policy Service double free lets local users gain admin rights"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "local-privilege-escalation", "patch-tuesday", "windows"]
not_affected_if: ["no-local-access", "no-local-untrusted-users"]
published_at: "2026-11-10T19:21:46+00:00"
first_seen_at: "2026-11-10T19:25:24+00:00"
updated_at: "2026-11-10T20:24:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95934", "first_seen_at": "2026-11-10T19:25:24+00:00"}, {"source": "analyst", "url": "https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95934", "first_seen_at": "2026-11-10T20:24:17+00:00", "cites": ["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95934"]}]
exploit_sources: []
---

# Windows: Diagnostic Policy Service double free lets local users gain admin rights

Link for people: https://infrastack.ai/live/CVE-2026-95934 (this .md is for agents)

Microsoft's November 2026 Patch Tuesday entry rates this Important (CVSS 7.8, local, low privileges, no user interaction). A double free (CWE-415) in the Windows Diagnostic Policy Service lets an attacker who already runs code on the machine as a low-privileged user gain SYSTEM. Microsoft says it is not publicly disclosed and not exploited, and rates exploitation Less Likely. Affected: any Windows machine where an attacker can already run code as a normal user (shared workstations, terminal or build servers, a laptop after a first-stage compromise). It is not remotely reachable by itself. The MSRC data I could read does not list affected builds.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run winver (or Get-ComputerInfo) and compare the build with the November 2026 cumulative update for your Windows version in the Security Update Guide entry for CVE-2026-95934. The MSRC data I could read gave no build list, so the exact fixed build numbers are unknown. sc query DPS shows whether the service runs, but it is on by default and is not a reliable exposure test.

## Fix

Install the November 2026 (released 2026-11-10) Windows security update for your version. MSRC marks customer action as required. Exact KB and fixed build numbers per version were not read; check the Security Update Guide.

## Timeline

- 2026-11-10T19:25:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95934
- 2026-11-10T20:24:17+00:00 analyst https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95934 — Read MSRC SUG API JSON for the CVE (primary): EoP, CVSS 7.8, not exploited, not disclosed. Per-product build list and KBs not retrievable (MSRC page is JS-only, CVRF fetch empty); nothing marked verified. No product rows written. X search not attempted.

## Documents

- [advisory] MSRC: CVE-2026-95934 Windows Diagnostic Policy Service Elevation of Privilege Vulnerability https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95934

## From the sources

Double free in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_