{"id":"CVE-2026-96008","kind":"vulnerability","aliases":["CVE-2026-96008"],"related":[],"title":"Windows Installer: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in Windows Installer lets a user who already has a local account raise their privileges. Sources give no further detail on the exact trigger.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9612"],"affected":">= 10.0.14393.0, < 10.0.14393.9612","ecosystem":"microsoft"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9376"],"affected":">= 10.0.17763.0, < 10.0.17763.9376","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7807"],"affected":">= 10.0.19044.0, < 10.0.19044.7807","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7807"],"affected":">= 10.0.19045.0, < 10.0.19045.7807","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7652"],"affected":">= 10.0.22631.0, < 10.0.22631.7652","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9711"],"affected":">= 10.0.26100.0, < 10.0.26100.9711","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9711"],"affected":">= 10.0.26200.0, < 10.0.26200.9711","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3231"],"affected":">= 10.0.28000.0, < 10.0.28000.3231","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9711"],"affected":">= 10.0.26300.0, < 10.0.26300.9711","ecosystem":"microsoft"},{"name":"Windows Server 2012","fixed":["6.2.9200.26434"],"affected":">= 6.2.9200.0, < 6.2.9200.26434","ecosystem":"microsoft"},{"name":"Windows Server 2012 R2","fixed":["6.3.9600.23470"],"affected":">= 6.3.9600.0, < 6.3.9600.23470","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5761"],"affected":">= 10.0.20348.0, < 10.0.20348.5761","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33650"],"affected":">= 10.0.26100.0, < 10.0.26100.33650","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows","windows-installer"],"not_affected_if":["fully-patched"],"how_to_check":"Run winver or PowerShell [System.Environment]::OSVersion.Version / (Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion).UBR and compare the full build number to the fixed build for your version; lower means exposed.","fix":"Install the November 2026 cumulative update that raises the build to at least the fixed build for your Windows version (e.g. Win 11 24H2 10.0.26100.9711, Server 2022 10.0.20348.5761, Server 2025 10.0.26100.33650, Win 10 22H2 10.0.19045.7807). KB numbers: unknown, see MSRC.","status":"open","published_at":"2026-11-10T19:21:57+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","triaged_at":"2026-11-10T19:49:35+00:00","updated_at":"2026-11-10T20:10:02+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:49:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Installer: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in Windows Installer lets a user who already has a local account raise their privileges. Sources give no further detail on the exact trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-installer"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains administrator or SYSTEM privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-96008 for affected Windows builds and the patch KB.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines that run the Windows Installer service. The sources do not say which Windows versions are affected or whether a non-default setting is needed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000639,"input_tokens":4474,"output_tokens":383,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-96008 for affected Windows builds and the patch KB.","search":"'-2026':15A,18A '-96008':16A,19A '10':21A,26A,31A,34A '11':37A,40A,43A,46A,49A '1607':22A '1809':27A '2012':53A,56A '2016':24A '2019':29A '2022':60A '2025':63A '21h2':32A '22h2':35A '23h2':38A '24h2':41A '25h2':44A '26h1':47A '26h2':50A 'account':90B 'allow':109C 'alreadi':86B 'attack':112C 'author':111C 'bug':78B 'cve':14A,17A 'detail':98B 'elev':114C 'escal':68B 'exact':101B 'free':6A,77B,105C 'gain':11A 'give':95B 'higher':12A 'infrastructur':64B 'instal':2A,72B,81B,108C 'let':7A,82B 'local':9A,66B,89B,116C 'local-privilege-escal':65B 'privileg':13A,67B,93B,115C 'r2':57A 'rais':91B 'server':23A,28A,52A,55A,59A,62A 'sourc':94B 'trigger':102B 'use':4A,75B,103C 'use-after-fre':3A,74B 'user':10A,84B 'window':1A,69B,71B,80B,107C 'windows':20A,25A,30A,33A,36A,39A,42A,45A,48A,51A,54A,58A,61A 'windows-instal':70B","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10, Windows 11 or Windows Server (2012 to 2025) machine below the fixed build is affected. An attacker needs a local account and a hard-to-hit race (AC:H), so shared machines, terminal servers, build agents and workstations with untrusted users matter most. Fully patched hosts, and single-user machines with no untrusted code, can wait for routine patching.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2012","server2012r2","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2012","windowsserver2012r2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2012","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","r2","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","windows","windowsinstaller"],"campaign_type":null,"search_a":"'-2026':15A,18A '-96008':16A,19A '10':21A,26A,31A,34A '11':37A,40A,43A,46A,49A '1607':22A '1809':27A '2012':53A,56A '2016':24A '2019':29A '2022':60A '2025':63A '21h2':32A '22h2':35A '23h2':38A '24h2':41A '25h2':44A '26h1':47A '26h2':50A 'cve':14A,17A 'free':6A 'gain':11A 'higher':12A 'instal':2A 'let':7A 'local':9A 'privileg':13A 'r2':57A 'server':23A,28A,52A,55A,59A,62A 'use':4A 'use-after-fre':3A 'user':10A 'window':1A 'windows':20A,25A,30A,33A,36A,39A,42A,45A,48A,51A,54A,58A,61A","search_b":"'account':90B 'alreadi':86B 'bug':78B 'detail':98B 'escal':68B 'exact':101B 'free':77B 'give':95B 'infrastructur':64B 'instal':72B,81B 'let':82B 'local':66B,89B 'local-privilege-escal':65B 'privileg':67B,93B 'rais':91B 'sourc':94B 'trigger':102B 'use':75B 'use-after-fre':74B 'user':84B 'window':69B,71B,80B 'windows-instal':70B","search_c":"'allow':109C 'attack':112C 'author':111C 'elev':114C 'free':105C 'instal':108C 'local':116C 'privileg':115C 'use':103C 'window':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96008","severity":null,"published_at":"2026-11-10T19:21:57+00:00","modified_at":"2026-11-10T19:21:57+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","fetched_at":"2026-11-10T19:25:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96008:2616","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96008","severity":null,"published_at":"2026-11-10T20:10:02+00:00","modified_at":"2026-11-10T20:10:02+00:00","first_seen_at":"2026-11-10T20:10:02+00:00","fetched_at":"2026-11-10T20:10:02+00:00","note":"NVD (Microsoft CNA data) lists affected builds; MSRC page is JS-only and unreadable here, so KB numbers unknown and nothing marked verified. No exploitation or PoC seen; no community search done (no product-specific chatter expected).","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-96008"]}],"documents":[{"id":117777,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96008","title":"NVD CVE-2026-96008 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}