---
id: "CVE-2026-95956"
page: "https://infrastack.ai/live/CVE-2026-95956"
kind: "vulnerability"
aliases: ["CVE-2026-95956"]
title: "Windows eSCL Scanner: use-after-free lets a network attacker run code"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["escl-scanner", "infrastructure", "network-printing", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:21:49+00:00"
first_seen_at: "2026-11-10T19:25:24+00:00"
updated_at: "2026-11-10T20:20:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95956", "first_seen_at": "2026-11-10T19:25:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T20:20:54+00:00"}]
exploit_sources: []
---

# Windows eSCL Scanner: use-after-free lets a network attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-95956 (this .md is for agents)

A use-after-free bug in the Windows eSCL scanner component lets an unauthorized attacker on the network trigger memory corruption. The sources say this allows the attacker to execute code on the affected Windows machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

unknown: Microsoft's advisory was not readable. Check the MSRC Update Guide entry for CVE-2026-95956 for affected builds, and install the November 2026 cumulative update for your Windows version.

## Timeline

- 2026-11-10T19:25:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95956
- 2026-11-10T20:20:54+00:00 analyst — MSRC page (JS-only), MSRC API and NVD returned no text via web-cli; only a third-party list (nextguardhq) confirms 'Windows eSCL Scanner Remote Code Execution', CVSS 8.1, listed Nov 9 2026 (November Patch Tuesday). No primary source read, so affected builds, KB/fixed update, and whether eSCL must be enabled stay unknown; nothing marked verified. To settle: open the MSRC Update Guide entry in a browser.

## From the sources

Use after free in Windows eSCL Scanner allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_