{"id":"CVE-2026-95956","kind":"vulnerability","aliases":["CVE-2026-95956"],"related":[],"title":"Windows eSCL Scanner: use-after-free lets a network attacker run code","description":"Use after free in Windows eSCL Scanner allows an unauthorized attacker to execute code over a network.","summary":"A use-after-free bug in the Windows eSCL scanner component lets an unauthorized attacker on the network trigger memory corruption. The sources say this allows the attacker to execute code on the affected Windows machine.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["escl-scanner","infrastructure","network-printing","windows"],"not_affected_if":[],"how_to_check":"unknown: Microsoft's advisory was not readable. Check the MSRC Update Guide entry for CVE-2026-95956 for affected builds, and install the November 2026 cumulative update for your Windows version.","fix":null,"status":"open","published_at":"2026-11-10T19:21:49+00:00","first_seen_at":"2026-11-10T19:25:24+00:00","triaged_at":"2026-11-10T19:34:33+00:00","updated_at":"2026-11-10T20:20:54+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:34:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows eSCL Scanner: use-after-free lets a network attacker run code","impact":"high","summary":"A use-after-free bug in the Windows eSCL scanner component lets an unauthorized attacker on the network trigger memory corruption. The sources say this allows the attacker to execute code on the affected Windows machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","escl-scanner","network-printing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the Windows machine over the network","analyst_note":"Find the Microsoft advisory for CVE-2026-95956 to confirm affected Windows builds, the fixed update, and whether scanner features must be enabled.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines that run the eSCL scanner component and are reachable over a network can be exposed. The sources do not say which Windows versions or configurations are affected, so unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":4484,"output_tokens":428,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-95956 to confirm affected Windows builds, the fixed update, and whether scanner features must be enabled.","search":"'-2026':15A,18A '-95956':16A,19A 'affect':62B 'allow':54B,72C 'attack':11A,43B,56B,75C 'bug':33B 'code':13A,59B,78C 'compon':39B 'corrupt':49B 'cve':14A,17A 'escl':2A,21B,37B,70C 'escl-scann':20B 'execut':58B,77C 'free':7A,32B,67C 'infrastructur':23B 'let':8A,40B 'machin':64B 'memori':48B 'network':10A,25B,46B,81C 'network-print':24B 'print':26B 'run':12A 'say':52B 'scanner':3A,22B,38B,71C 'sourc':51B 'trigger':47B 'unauthor':42B,74C 'use':5A,30B,65C 'use-after-fre':4A,29B 'window':1A,27B,36B,63B,69C","nicknames":[],"mitigations":[],"who_affected":"Windows machines running the eSCL scanner component that are reachable over a network may be exposed (CVSS 8.1, network, no privileges, high attack complexity). Affected Windows builds and whether the scanner feature must be enabled are not confirmed from Microsoft's own page, so unknown. Systems with no network scanning or printing features in use may be able to skip it once that is confirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["esclscanner","high","infrastructure","networkprinting","windows"],"campaign_type":null,"search_a":"'-2026':15A,18A '-95956':16A,19A 'attack':11A 'code':13A 'cve':14A,17A 'escl':2A 'free':7A 'let':8A 'network':10A 'run':12A 'scanner':3A 'use':5A 'use-after-fre':4A 'window':1A","search_b":"'affect':62B 'allow':54B 'attack':43B,56B 'bug':33B 'code':59B 'compon':39B 'corrupt':49B 'escl':21B,37B 'escl-scann':20B 'execut':58B 'free':32B 'infrastructur':23B 'let':40B 'machin':64B 'memori':48B 'network':25B,46B 'network-print':24B 'print':26B 'say':52B 'scanner':22B,38B 'sourc':51B 'trigger':47B 'unauthor':42B 'use':30B 'use-after-fre':29B 'window':27B,36B,63B","search_c":"'allow':72C 'attack':75C 'code':78C 'escl':70C 'execut':77C 'free':67C 'network':81C 'scanner':71C 'unauthor':74C 'use':65C 'window':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95956","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95956","severity":null,"published_at":"2026-11-10T19:21:49+00:00","modified_at":"2026-11-10T19:21:49+00:00","first_seen_at":"2026-11-10T19:25:24+00:00","fetched_at":"2026-11-10T19:25:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95956:2642","url":null,"severity":null,"published_at":"2026-11-10T20:20:54+00:00","modified_at":"2026-11-10T20:20:54+00:00","first_seen_at":"2026-11-10T20:20:54+00:00","fetched_at":"2026-11-10T20:20:54+00:00","note":"MSRC page (JS-only), MSRC API and NVD returned no text via web-cli; only a third-party list (nextguardhq) confirms 'Windows eSCL Scanner Remote Code Execution', CVSS 8.1, listed Nov 9 2026 (November Patch Tuesday). No primary source read, so affected builds, KB/fixed update, and whether eSCL must be enabled stay unknown; nothing marked verified. To settle: open the MSRC Update Guide entry in a browser."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}