{"id":"CVE-2026-95968","kind":"vulnerability","aliases":["CVE-2026-95968"],"related":[],"title":"Windows Smart Card: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally.","summary":"Use-after-free (CWE-416/822) in Windows Smart Card lets a local user with a low-privilege account gain higher privileges (CVSS 7.0, attack complexity high, no user interaction). Microsoft's CNA record lists Windows 10, 11 and Server builds; not reported exploited. Fixed build/KB not confirmed from the Microsoft page.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","smart-card","windows","windows-server"],"not_affected_if":["no-smart-card-use"],"how_to_check":"Run winver and compare the build (e.g. 10.0.26100.x) with the table in Microsoft's Security Update Guide entry for CVE-2026-95968. Per Microsoft's CNA record, builds up to and including these are affected: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. The exact fixed build and KB are unconfirmed.","fix":null,"status":"open","published_at":"2026-11-10T19:21:53+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","triaged_at":"2026-11-10T19:49:46+00:00","updated_at":"2026-11-10T20:17:53+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:49:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Smart Card: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in the Windows Smart Card component lets an attacker who already has an authorized local account run code with higher privileges. The attacker needs local access first, and the sources do not say how the bug is triggered.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","smart-card"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the affected Windows builds and the patch KB from Microsoft's security update guide entry for CVE-2026-95968; the NVD record gives no version ranges.","how_to_check":"- Check the Windows build with `winver` and compare it against Microsoft's security update guide entry for CVE-2026-95968\n- Confirm whether the Smart Card service (SCardSvr) is running with `sc query SCardSvr`\n- unknown for any product-specific configuration check","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-smart-card-use"],"who_is_affected":"Windows machines that use the Smart Card component, which is common on managed corporate laptops and workstations that log in with smart cards or tokens. The sources do not name the affected Windows builds, so the exact exposure is unknown. Systems with no local users other than trusted administrators are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4478,"output_tokens":558,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and the patch KB from Microsoft's security update guide entry for CVE-2026-95968; the NVD record gives no version ranges.","search":"'-2026':16A,19A '-416':38B '-95968':17A,20A '/822':39B '10':71B '11':72B '7.0':58B 'account':53B 'allow':94C 'attack':59B,97C 'author':96C 'build':75B 'build/kb':80B 'card':3A,28B,43B,93C 'cna':67B 'complex':60B 'confirm':82B 'cve':15A,18A 'cvss':57B 'cwe':37B 'elev':99C 'escal':25B 'exploit':78B 'fix':79B 'free':7A,36B,89C 'gain':12A,54B 'high':61B 'higher':13A,55B 'infrastructur':21B 'interact':64B 'let':8A,44B 'list':69B 'local':10A,23B,46B,101C 'local-privilege-escal':22B 'low':51B 'low-privileg':50B 'microsoft':65B,85B 'page':86B 'privileg':14A,24B,52B,56B,100C 'record':68B 'report':77B 'server':32B,74B 'smart':2A,27B,42B,92C 'smart-card':26B 'use':5A,34B,87C 'use-after-fre':4A,33B 'user':11A,47B,63B 'window':1A,29B,31B,41B,70B,91C 'windows-serv':30B","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) or Windows Server (2016, 2019, 2022, 2025) machine below the fixed build, where an attacker already has a low-privilege local account. Remote-only attackers cannot use it directly. Shared machines, terminal servers and VDI hosts matter most; single-user machines with no untrusted local code are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","smartcard","windows","windowsserver"],"campaign_type":null,"search_a":"'-2026':16A,19A '-95968':17A,20A 'card':3A 'cve':15A,18A 'free':7A 'gain':12A 'higher':13A 'let':8A 'local':10A 'privileg':14A 'smart':2A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A","search_b":"'-416':38B '/822':39B '10':71B '11':72B '7.0':58B 'account':53B 'attack':59B 'build':75B 'build/kb':80B 'card':28B,43B 'cna':67B 'complex':60B 'confirm':82B 'cvss':57B 'cwe':37B 'escal':25B 'exploit':78B 'fix':79B 'free':36B 'gain':54B 'high':61B 'higher':55B 'infrastructur':21B 'interact':64B 'let':44B 'list':69B 'local':23B,46B 'local-privilege-escal':22B 'low':51B 'low-privileg':50B 'microsoft':65B,85B 'page':86B 'privileg':24B,52B,56B 'record':68B 'report':77B 'server':32B,74B 'smart':27B,42B 'smart-card':26B 'use':34B 'use-after-fre':33B 'user':47B,63B 'window':29B,31B,41B,70B 'windows-serv':30B","search_c":"'allow':94C 'attack':97C 'author':96C 'card':93C 'elev':99C 'free':89C 'local':101C 'privileg':100C 'smart':92C 'use':87C 'window':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95968","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95968","severity":null,"published_at":"2026-11-10T19:21:53+00:00","modified_at":"2026-11-10T19:21:53+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","fetched_at":"2026-11-10T19:25:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95968:2635","url":"https://cve.report/CVE-2026-95968","severity":null,"published_at":"2026-11-10T20:17:53+00:00","modified_at":"2026-11-10T20:17:53+00:00","first_seen_at":"2026-11-10T20:17:53+00:00","fetched_at":"2026-11-10T20:17:53+00:00","note":"MSRC page is JS-only and unreadable here; affected builds taken from Microsoft CNA record via CVE.report mirror (not primary, nothing verified). KB numbers not found. Not exploited per sources I could read; no PoC seen.","cites":["https://cve.report/CVE-2026-95968"]}],"documents":[{"id":117999,"url":"https://cve.report/CVE-2026-95968","title":"CVE-2026-95968 (CVE.report mirror of Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}