{"id":"CVE-2026-95947","kind":"vulnerability","aliases":["CVE-2026-95947"],"related":[],"title":"Windows Error Reporting: local file handling lets an attacker gain higher privileges","description":"An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.\nAn attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. To exploit the vulnerability, an attacker could run a specially crafted application.\nThe security update addresses the vulnerability by correcting the way that WER handles and executes files.","summary":"Windows Error Reporting mishandles how it runs files, letting a local attacker elevate privileges on the Windows machine. An attacker who runs a specially crafted application can gain greater access to sensitive information and system functions.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607","fixed":["10.0.14393.9688"],"affected":">= 10.0.14393.0, < 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows 10 1809","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":">= 10.0.19044.0, < 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">= 10.0.22631.0, < 10.0.22631.7711","ecosystem":"vendor"}],"ecosystems":[],"tags":["endpoints","infrastructure","local-privilege-escalation","windows","windows-10","windows-11"],"not_affected_if":["non-windows-systems","patched-builds"],"how_to_check":"Run winver (or PowerShell [System.Environment]::OSVersion.Version) and compare the full build number (e.g. 10.0.19045.xxxx) with the fixed builds: below 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846 or 10.0.22631.7711 on the matching Windows version means exposed. Settings > Windows Update > Update history shows whether the November 2026 cumulative update is installed. Also check other Windows versions and Server builds in Microsoft's update guide.","fix":"Install the November 2026 Windows cumulative update that brings the build to at least: 10.0.14393.9688 (Win10 1607), 10.0.17763.9487 (1809), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (Win11 23H2). The KB numbers are not confirmed; look them up in Microsoft's Security Update Guide for CVE-2026-95947. Builds for other Windows versions (the listing shows 5 more) are unconfirmed.","status":"open","published_at":"2026-11-10T19:21:47+00:00","first_seen_at":"2026-11-10T19:25:24+00:00","triaged_at":"2026-11-10T19:38:13+00:00","updated_at":"2026-11-10T20:22:16+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Error Reporting: local file handling lets an attacker gain higher privileges","impact":"high","summary":"Windows Error Reporting mishandles how it runs files, letting a local attacker elevate privileges on the Windows machine. An attacker who runs a specially crafted application can gain greater access to sensitive information and system functions.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","endpoints"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local attacker gains higher system privileges on the Windows machine","analyst_note":"Find Microsoft's advisory for CVE-2026-95947 to get affected Windows builds, fixed update KBs, and whether a user action is needed.","how_to_check":"- Check the installed Windows build with `winver` and compare it against Microsoft's update guide for CVE-2026-95947\n- Confirm whether the Windows security update that addresses this CVE is installed under Settings > Windows Update > Update history","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["non-windows-systems"],"who_is_affected":"Any Windows machine where a local user or application can run code is in scope, since the attacker must run a crafted application on the system. The sources do not name the affected Windows builds, so check Microsoft's advisory for the exact range. Machines where only trusted users log on and no untrusted code runs are lower risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000735,"input_tokens":4612,"output_tokens":548,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Microsoft's advisory for CVE-2026-95947 to get affected Windows builds, fixed update KBs, and whether a user action is needed.","search":"'-10':42B '-11':44B '-2026':14A,17A '-95947':15A,18A '10':20A,23A,26A,29A '11':32A '1607':21A '1809':24A '21h2':27A '22h2':30A '23h2':33A 'access':74B,122C 'address':144C 'allow':101C 'applic':70B,140C 'attack':9A,56B,64B,107C,113C,134C 'correct':148C 'could':100C,119C,135C 'craft':69B,139C 'cve':13A,16A 'elev':57B,82C,102C 'endpoint':34B 'error':2A,46B,89C 'escal':39B 'execut':96C,155C 'exist':86C 'exploit':110C,116C,130C 'file':5A,52B,97C,156C 'function':80B,128C 'gain':10A,72B,120C 'greater':73B,121C 'handl':6A,94C,153C 'higher':11A 'inform':77B,125C 'infrastructur':35B 'let':7A,53B 'local':4A,37B,55B 'local-privilege-escal':36B 'machin':62B 'mishandl':48B 'privileg':12A,38B,58B,84C,104C 'report':3A,47B,90C 'run':51B,66B,136C 'secur':142C 'sensit':76B,124C 'special':68B,138C 'success':109C,115C 'system':79B,127C 'updat':143C 'vulner':85C,99C,118C,132C,146C 'way':150C 'wer':91C,93C,152C 'window':1A,40B,41B,43B,45B,61B,88C 'windows':19A,22A,25A,28A,31A","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine where a local user or application can run code is in scope, since the attacker must run a crafted application on the system. The sources do not name the affected Windows builds, so check Microsoft's advisory for the exact range. Machines where only trusted users log on and no untrusted code runs are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607","101809","1021h2","1022h2","1123h2","windows101607","windows101809","windows1021h2","windows1022h2","windows1123h2"],"ptokens":["10","11","1607","1809","21h2","22h2","23h2","windows"],"labels":["endpoints","high","infrastructure","localprivilegeescalation","windows","windows10","windows11"],"campaign_type":null,"search_a":"'-2026':14A,17A '-95947':15A,18A '10':20A,23A,26A,29A '11':32A '1607':21A '1809':24A '21h2':27A '22h2':30A '23h2':33A 'attack':9A 'cve':13A,16A 'error':2A 'file':5A 'gain':10A 'handl':6A 'higher':11A 'let':7A 'local':4A 'privileg':12A 'report':3A 'window':1A 'windows':19A,22A,25A,28A,31A","search_b":"'-10':42B '-11':44B 'access':74B 'applic':70B 'attack':56B,64B 'craft':69B 'elev':57B 'endpoint':34B 'error':46B 'escal':39B 'file':52B 'function':80B 'gain':72B 'greater':73B 'inform':77B 'infrastructur':35B 'let':53B 'local':37B,55B 'local-privilege-escal':36B 'machin':62B 'mishandl':48B 'privileg':38B,58B 'report':47B 'run':51B,66B 'sensit':76B 'special':68B 'system':79B 'window':40B,41B,43B,45B,61B","search_c":"'access':122C 'address':144C 'allow':101C 'applic':140C 'attack':107C,113C,134C 'correct':148C 'could':100C,119C,135C 'craft':139C 'elev':82C,102C 'error':89C 'execut':96C,155C 'exist':86C 'exploit':110C,116C,130C 'file':97C,156C 'function':128C 'gain':120C 'greater':121C 'handl':94C,153C 'inform':125C 'privileg':84C,104C 'report':90C 'run':136C 'secur':142C 'sensit':124C 'special':138C 'success':109C,115C 'system':127C 'updat':143C 'vulner':85C,99C,118C,132C,146C 'way':150C 'wer':91C,93C,152C 'window':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95947","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95947","severity":null,"published_at":"2026-11-10T19:21:47+00:00","modified_at":"2026-11-10T19:21:47+00:00","first_seen_at":"2026-11-10T19:25:24+00:00","fetched_at":"2026-11-10T19:25:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95947:2647","url":"https://radar.offseq.com/threat/cve-2026-95947-cwe-306-missing-authentication-for-critical-functionality-in-microsoft-windows-10-ffe45a8b4d88ce74","severity":null,"published_at":"2026-11-10T20:22:16+00:00","modified_at":"2026-11-10T20:22:16+00:00","first_seen_at":"2026-11-10T20:22:16+00:00","fetched_at":"2026-11-10T20:22:16+00:00","note":"MSRC page is JS-only and unreadable here; builds taken from OffSeq's copy of the Microsoft CNA record (secondary), so nothing marked verified. KB numbers not found. No exploitation or PoC known.","cites":["https://radar.offseq.com/threat/cve-2026-95947-cwe-306-missing-authentication-for-critical-functionality-in-microsoft-windows-10-ffe45a8b4d88ce74"]}],"documents":[{"id":118014,"url":"https://radar.offseq.com/threat/cve-2026-95947-cwe-306-missing-authentication-for-critical-functionality-in-microsoft-windows-10-ffe45a8b4d88ce74","title":"OffSeq Threat Radar: CVE-2026-95947 (mirrors Microsoft CVE record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}