{"id":"CVE-2026-96016","kind":"vulnerability","aliases":["CVE-2026-96016"],"related":[],"title":"Windows LSASS: heap overflow lets a local user gain elevated privileges","description":"Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Local Security Authority Subsystem Service (LSASS) lets an authorized local user escalate privileges. An attacker who already has a login on the machine can gain higher system rights.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":">= 10.0.26100.0, < 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":">= 10.0.26200.0, < 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":">= 10.0.28000.0, < 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":">= 10.0.26300.0, < 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":">= 10.0.20348.0, < 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["endpoints","infrastructure","lsass","windows","windows-11","windows-server"],"not_affected_if":["no-local-logon","patched-november-2026"],"how_to_check":"Run winver or [System.Environment]::OSVersion / 'cmd /c ver' and compare the full build (e.g. 10.0.26100.xxxx) with the fixed builds; lower means exposed. Windows 10 and Server 2016/2019 are not in Microsoft's affected list.","fix":"Install the November 2026 Windows cumulative update that brings the build to at least: Win11 24H2 10.0.26100.9974, 25H2 10.0.26200.9974, 26H1 10.0.28000.3501, 26H2 10.0.26300.9974, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822. KB numbers not confirmed; check the MSRC page.","status":"open","published_at":"2026-11-10T19:21:57+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","triaged_at":"2026-11-10T19:36:52+00:00","updated_at":"2026-11-10T20:10:16+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:36:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows LSASS: heap overflow lets a local user gain elevated privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Local Security Authority Subsystem Service (LSASS) lets an authorized local user escalate privileges. An attacker who already has a login on the machine can gain higher system rights.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","lsass","endpoints"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the affected Windows builds and the Microsoft patch for CVE-2026-96016 in the MSRC advisory; the NVD entry gives neither.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-logon"],"who_is_affected":"Windows machines where users have local logon are the exposed systems, since the attacker must already be authorized on the host. The sources do not list affected Windows builds or the patch. Systems with no untrusted local users carry lower practical risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":4511,"output_tokens":451,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and the Microsoft patch for CVE-2026-96016 in the MSRC advisory; the NVD entry gives neither.","search":"'-11':41B '-2026':13A,16A '-96016':14A,17A '11':19A,22A,25A,28A '2022':32A '2025':35A '24h2':20A '25h2':23A '26h1':26A '26h2':29A 'allow':95C 'alreadi':70B 'attack':68B,98C 'author':56B,62B,91C,97C 'base':48B,84C 'buffer':49B,85C 'cve':12A,15A 'elev':10A,100C 'endpoint':36B 'escal':65B 'gain':9A,78B 'heap':3A,47B,83C 'heap-bas':46B,82C 'higher':79B 'infrastructur':37B 'let':5A,60B 'local':7A,54B,63B,89C,102C 'login':73B 'lsass':2A,38B,59B,94C 'machin':76B 'overflow':4A,50B,86C 'privileg':11A,66B,101C 'right':81B 'secur':55B,90C 'server':31A,34A,44B 'servic':58B,93C 'subsystem':57B,92C 'system':80B 'user':8A,64B 'window':1A,39B,40B,43B,53B,88C 'windows':18A,21A,24A,27A,30A,33A 'windows-serv':42B","nicknames":[],"mitigations":[],"who_affected":"Windows 11 (24H2, 25H2, 26H1, 26H2) and Windows Server 2022 and 2025 (including Server Core) below the fixed builds are affected. An attacker needs a local, low-privilege logon on the machine to reach LSASS and gain higher rights. Hosts with no untrusted local or remote-desktop users, such as single-user machines, carry lower practical risk, but should still be patched.","tier":"B","verified":{"products":{"at":"2026-11-10T20:10:16Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-96016","run_id":2614}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["11","2022","2025","24h2","25h2","26h1","26h2","server","windows"],"labels":["endpoints","high","infrastructure","lsass","windows","windows11","windowsserver"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96016':14A,17A '11':19A,22A,25A,28A '2022':32A '2025':35A '24h2':20A '25h2':23A '26h1':26A '26h2':29A 'cve':12A,15A 'elev':10A 'gain':9A 'heap':3A 'let':5A 'local':7A 'lsass':2A 'overflow':4A 'privileg':11A 'server':31A,34A 'user':8A 'window':1A 'windows':18A,21A,24A,27A,30A,33A","search_b":"'-11':41B 'alreadi':70B 'attack':68B 'author':56B,62B 'base':48B 'buffer':49B 'endpoint':36B 'escal':65B 'gain':78B 'heap':47B 'heap-bas':46B 'higher':79B 'infrastructur':37B 'let':60B 'local':54B,63B 'login':73B 'lsass':38B,59B 'machin':76B 'overflow':50B 'privileg':66B 'right':81B 'secur':55B 'server':44B 'servic':58B 'subsystem':57B 'system':80B 'user':64B 'window':39B,40B,43B,53B 'windows-serv':42B","search_c":"'allow':95C 'attack':98C 'author':91C,97C 'base':84C 'buffer':85C 'elev':100C 'heap':83C 'heap-bas':82C 'local':89C,102C 'lsass':94C 'overflow':86C 'privileg':101C 'secur':90C 'servic':93C 'subsystem':92C 'window':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96016","severity":null,"published_at":"2026-11-10T19:21:57+00:00","modified_at":"2026-11-10T19:21:58+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","fetched_at":"2026-11-10T19:25:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96016:2614","url":"https://cveawg.mitre.org/api/cve/CVE-2026-96016","severity":null,"published_at":"2026-11-10T20:10:16+00:00","modified_at":"2026-11-10T20:10:16+00:00","first_seen_at":"2026-11-10T20:10:16+00:00","fetched_at":"2026-11-10T20:10:16+00:00","note":"MSRC page is JS-only and unreadable here; used Microsoft's own CVE record (CNA) for builds. No KB numbers found, no exploitation or PoC seen. Verified products only.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-96016"]}],"documents":[{"id":117779,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-96016","title":"CVE-2026-96016 CVE record (Microsoft CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}