---
id: "CVE-2026-96008"
page: "https://infrastack.ai/live/CVE-2026-96008"
kind: "vulnerability"
aliases: ["CVE-2026-96008"]
title: "Windows Installer: use-after-free lets a local user gain higher privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 10 1607 / Server 2016", "fixed": ["10.0.14393.9612"], "affected": ">= 10.0.14393.0, < 10.0.14393.9612", "ecosystem": "microsoft"}, {"name": "Windows 10 1809 / Server 2019", "fixed": ["10.0.17763.9376"], "affected": ">= 10.0.17763.0, < 10.0.17763.9376", "ecosystem": "microsoft"}, {"name": "Windows 10 21H2", "fixed": ["10.0.19044.7807"], "affected": ">= 10.0.19044.0, < 10.0.19044.7807", "ecosystem": "microsoft"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7807"], "affected": ">= 10.0.19045.0, < 10.0.19045.7807", "ecosystem": "microsoft"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7652"], "affected": ">= 10.0.22631.0, < 10.0.22631.7652", "ecosystem": "microsoft"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9711"], "affected": ">= 10.0.26100.0, < 10.0.26100.9711", "ecosystem": "microsoft"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9711"], "affected": ">= 10.0.26200.0, < 10.0.26200.9711", "ecosystem": "microsoft"}, {"name": "Windows 11 26H1", "fixed": ["10.0.28000.3231"], "affected": ">= 10.0.28000.0, < 10.0.28000.3231", "ecosystem": "microsoft"}, {"name": "Windows 11 26H2", "fixed": ["10.0.26300.9711"], "affected": ">= 10.0.26300.0, < 10.0.26300.9711", "ecosystem": "microsoft"}, {"name": "Windows Server 2012", "fixed": ["6.2.9200.26434"], "affected": ">= 6.2.9200.0, < 6.2.9200.26434", "ecosystem": "microsoft"}, {"name": "Windows Server 2012 R2", "fixed": ["6.3.9600.23470"], "affected": ">= 6.3.9600.0, < 6.3.9600.23470", "ecosystem": "microsoft"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5761"], "affected": ">= 10.0.20348.0, < 10.0.20348.5761", "ecosystem": "microsoft"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33650"], "affected": ">= 10.0.26100.0, < 10.0.26100.33650", "ecosystem": "microsoft"}]
ecosystems: []
tags: ["infrastructure", "local-privilege-escalation", "windows", "windows-installer"]
not_affected_if: ["fully-patched"]
published_at: "2026-11-10T19:21:57+00:00"
first_seen_at: "2026-11-10T19:25:27+00:00"
updated_at: "2026-11-10T20:10:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96008", "first_seen_at": "2026-11-10T19:25:27+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96008", "first_seen_at": "2026-11-10T20:10:02+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-96008"]}]
exploit_sources: []
---

# Windows Installer: use-after-free lets a local user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-96008 (this .md is for agents)

A use-after-free bug in Windows Installer lets a user who already has a local account raise their privileges. Sources give no further detail on the exact trigger.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- microsoft:Windows 10 1607 / Server 2016 affected >= 10.0.14393.0, < 10.0.14393.9612 fixed 10.0.14393.9612
- microsoft:Windows 10 1809 / Server 2019 affected >= 10.0.17763.0, < 10.0.17763.9376 fixed 10.0.17763.9376
- microsoft:Windows 10 21H2 affected >= 10.0.19044.0, < 10.0.19044.7807 fixed 10.0.19044.7807
- microsoft:Windows 10 22H2 affected >= 10.0.19045.0, < 10.0.19045.7807 fixed 10.0.19045.7807
- microsoft:Windows 11 23H2 affected >= 10.0.22631.0, < 10.0.22631.7652 fixed 10.0.22631.7652
- microsoft:Windows 11 24H2 affected >= 10.0.26100.0, < 10.0.26100.9711 fixed 10.0.26100.9711
- microsoft:Windows 11 25H2 affected >= 10.0.26200.0, < 10.0.26200.9711 fixed 10.0.26200.9711
- microsoft:Windows 11 26H1 affected >= 10.0.28000.0, < 10.0.28000.3231 fixed 10.0.28000.3231
- microsoft:Windows 11 26H2 affected >= 10.0.26300.0, < 10.0.26300.9711 fixed 10.0.26300.9711
- microsoft:Windows Server 2012 affected >= 6.2.9200.0, < 6.2.9200.26434 fixed 6.2.9200.26434
- microsoft:Windows Server 2012 R2 affected >= 6.3.9600.0, < 6.3.9600.23470 fixed 6.3.9600.23470
- microsoft:Windows Server 2022 affected >= 10.0.20348.0, < 10.0.20348.5761 fixed 10.0.20348.5761
- microsoft:Windows Server 2025 affected >= 10.0.26100.0, < 10.0.26100.33650 fixed 10.0.26100.33650

## How to check

Run winver or PowerShell [System.Environment]::OSVersion.Version / (Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion).UBR and compare the full build number to the fixed build for your version; lower means exposed.

## Fix

Install the November 2026 cumulative update that raises the build to at least the fixed build for your Windows version (e.g. Win 11 24H2 10.0.26100.9711, Server 2022 10.0.20348.5761, Server 2025 10.0.26100.33650, Win 10 22H2 10.0.19045.7807). KB numbers: unknown, see MSRC.

## Timeline

- 2026-11-10T19:25:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96008
- 2026-11-10T20:10:02+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-96008 — NVD (Microsoft CNA data) lists affected builds; MSRC page is JS-only and unreadable here, so KB numbers unknown and nothing marked verified. No exploitation or PoC seen; no community search done (no product-specific chatter expected).

## Documents

- [describes] NVD CVE-2026-96008 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/CVE-2026-96008

## From the sources

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_