---
id: "CVE-2026-95987"
page: "https://infrastack.ai/live/CVE-2026-95987"
kind: "vulnerability"
aliases: ["CVE-2026-95987"]
title: "Windows User Manager Service: use-after-free lets a local user gain privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": "< 10.0.26100.9974", "ecosystem": "microsoft"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9974"], "affected": "< 10.0.26200.9974", "ecosystem": "microsoft"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": "< 10.0.22631.7711", "ecosystem": "microsoft"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": "< 10.0.19045.7846", "ecosystem": "microsoft"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": "< 10.0.20348.5870", "ecosystem": "microsoft"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": "< 10.0.26100.33822", "ecosystem": "microsoft"}, {"name": "Windows Server 2019", "fixed": ["10.0.17763.9487"], "affected": "< 10.0.17763.9487", "ecosystem": "microsoft"}, {"name": "Windows Server 2016", "fixed": ["10.0.14393.9688"], "affected": "< 10.0.14393.9688", "ecosystem": "microsoft"}]
ecosystems: []
tags: ["infrastructure", "local", "privilege-escalation", "windows"]
not_affected_if: ["no-local-untrusted-users"]
published_at: "2026-11-10T19:21:55+00:00"
first_seen_at: "2026-11-10T19:25:26+00:00"
updated_at: "2026-11-10T20:14:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95987", "first_seen_at": "2026-11-10T19:25:26+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95987", "first_seen_at": "2026-11-10T20:14:30+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-95987"]}]
exploit_sources: []
---

# Windows User Manager Service: use-after-free lets a local user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-95987 (this .md is for agents)

A use-after-free in the Windows User Manager Service lets a user with a local low-privilege account gain higher privileges (CVSS 7.0, local, high complexity). Microsoft's CNA data on NVD lists fixed build numbers per Windows version. The KB numbers and whether it is exploited are not confirmed; the MSRC page could not be read.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- microsoft:Windows 11 24H2 affected < 10.0.26100.9974 fixed 10.0.26100.9974
- microsoft:Windows 11 25H2 affected < 10.0.26200.9974 fixed 10.0.26200.9974
- microsoft:Windows 11 23H2 affected < 10.0.22631.7711 fixed 10.0.22631.7711
- microsoft:Windows 10 22H2 affected < 10.0.19045.7846 fixed 10.0.19045.7846
- microsoft:Windows Server 2022 affected < 10.0.20348.5870 fixed 10.0.20348.5870
- microsoft:Windows Server 2025 affected < 10.0.26100.33822 fixed 10.0.26100.33822
- microsoft:Windows Server 2019 affected < 10.0.17763.9487 fixed 10.0.17763.9487
- microsoft:Windows Server 2016 affected < 10.0.14393.9688 fixed 10.0.14393.9688

## How to check

Run 'winver' or PowerShell '[System.Environment]::OSVersion.Version' and compare the build (e.g. 10.0.26100.x) against the fixed builds. Below the fixed build means exposed. Look up the KB for your build in the MSRC entry for CVE-2026-95987.

## Fix

Install the November 2026 Windows cumulative update. Fixed builds per NVD/Microsoft: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. KB numbers unconfirmed.

## Timeline

- 2026-11-10T19:25:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95987
- 2026-11-10T20:14:30+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-95987 — MSRC page is JS-only and unreadable here; affected builds taken from Microsoft CNA data on NVD. KB numbers and exploitation status not seen; nothing marked verified.

## Documents

- [describes] NVD CVE-2026-95987 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/CVE-2026-95987

## From the sources

Use after free in Windows User Manager Service allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_