---
id: "CVE-2026-95961"
page: "https://infrastack.ai/live/CVE-2026-95961"
kind: "vulnerability"
aliases: ["CVE-2026-95961"]
title: "Windows USB Video Driver: double free lets a local user gain higher privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "local-privilege-escalation", "usb-video-driver", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:21:50+00:00"
first_seen_at: "2026-11-10T19:25:25+00:00"
updated_at: "2026-11-10T20:19:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95961", "first_seen_at": "2026-11-10T19:25:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T20:19:00+00:00"}]
exploit_sources: []
---

# Windows USB Video Driver: double free lets a local user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-95961 (this .md is for agents)

A double free bug in the Windows USB Video Driver lets an attacker who already has a local account raise their privileges. The sources do not describe a remote path.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

unknown: the Microsoft entry was unreadable. Check Windows Update history for the November 2026 cumulative update (released 2026-11-10) and compare your build to the MSRC entry for CVE-2026-95961.

## Fix

Install the November 2026 Windows security update (released 2026-11-10). The exact KB and build numbers are unknown until the MSRC entry is read.

## Timeline

- 2026-11-10T19:25:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95961
- 2026-11-10T20:19:00+00:00 analyst — Part of Microsoft's November 2026 Patch Tuesday (released 2026-11-10; the MSRC feed lists it in 2026-Nov). I could not read the MSRC entry. It loads only through JavaScript, the CVRF document came back empty, and the browser is out of minutes. NVD and cve.org returned no content. Affected builds and fix KB are unknown. To settle it, open the MSRC Security Update Guide entry or the 2026-Nov CVRF. Nothing is marked verified. Nothing found on exploitation or a PoC; I did not search social posts.

## From the sources

Double free in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_