{"id":"CVE-2026-96019","kind":"vulnerability","aliases":["CVE-2026-96019"],"related":[],"title":"Windows Installer: race condition lets a local user gain higher privileges","description":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"A race condition in Windows Installer lets an attacker who already has a local account run code with higher privileges. The sources give no more detail on the exact flaw.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607","fixed":["10.0.14393.9688"],"affected":">=10.0.14393.0, <10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 10 1809","fixed":["10.0.17763.9487"],"affected":">=10.0.17763.0, <10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":">=10.0.19044.0, <10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">=10.0.19045.0, <10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">=10.0.22631.0, <10.0.22631.7711","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","windows","windows-installer"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"Run winver (or [System.Environment]::OSVersion.Version in PowerShell) and compare the full build number with the fixed builds in the MSRC entry for CVE-2026-96019. A build below the fixed number is exposed. Only local, low-privileged accounts can exploit it.","fix":"Install the November 2026 Windows cumulative update for your version. Per a CVE-record mirror (not Microsoft's page), fixed builds: Windows 10 1607 10.0.14393.9688; 1809 10.0.17763.9487; 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Windows 11 23H2 10.0.22631.7711. The mirror said 11 builds are fixed but listed only these 5 products, so check the MSRC entry for the rest.","status":"open","published_at":"2026-11-10T19:21:58+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","triaged_at":"2026-11-10T19:49:34+00:00","updated_at":"2026-11-10T20:10:26+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:49:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Installer: race condition lets a local user gain higher privileges","impact":"high","summary":"A race condition in Windows Installer lets an attacker who already has a local account run code with higher privileges. The sources give no more detail on the exact flaw.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-installer"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains system-level privileges on the machine","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-96019 to confirm affected Windows builds and the patch.","how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update guide entry for CVE-2026-96019.\n- Confirm whether Windows Installer (msiexec) is in use on the machine: `msiexec /?` returns version information.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Windows machines where an attacker already has a local user account can run the flawed Windows Installer code to elevate privileges. The sources do not say which Windows versions are affected or which systems are most exposed. Machines with no untrusted local users have lower exposure.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0007,"input_tokens":4499,"output_tokens":500,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-96019 to confirm affected Windows builds and the patch.","search":"'-2026':13A,16A '-96019':14A,17A '10':19A,22A,25A,28A '11':31A '1607':20A '1809':23A '21h2':26A '22h2':29A '23h2':32A 'account':52B 'allow':81C 'alreadi':48B 'attack':46B,84C 'author':83C 'code':54B 'concurr':68C 'condit':4A,40B,77C 'cve':12A,15A 'detail':63B 'elev':86C 'exact':66B 'execut':69C 'flaw':67B 'gain':9A 'give':60B 'higher':10A,56B 'improp':74C 'infrastructur':33B 'instal':2A,37B,43B,80C 'let':5A,44B 'local':7A,51B,88C 'privileg':11A,57B,87C 'race':3A,39B,76C 'resourc':72C 'run':53B 'share':71C 'sourc':59B 'synchron':75C 'use':70C 'user':8A 'window':1A,34B,36B,42B,79C 'windows':18A,21A,24A,27A,30A 'windows-instal':35B","nicknames":[],"mitigations":[],"who_affected":"Windows machines where an attacker already has a local user account can run the flawed Windows Installer code to elevate privileges. The sources do not say which Windows versions are affected or which systems are most exposed. Machines with no untrusted local users have lower exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607","101809","1021h2","1022h2","1123h2","windows101607","windows101809","windows1021h2","windows1022h2","windows1123h2"],"ptokens":["10","11","1607","1809","21h2","22h2","23h2","windows"],"labels":["high","infrastructure","windows","windowsinstaller"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96019':14A,17A '10':19A,22A,25A,28A '11':31A '1607':20A '1809':23A '21h2':26A '22h2':29A '23h2':32A 'condit':4A 'cve':12A,15A 'gain':9A 'higher':10A 'instal':2A 'let':5A 'local':7A 'privileg':11A 'race':3A 'user':8A 'window':1A 'windows':18A,21A,24A,27A,30A","search_b":"'account':52B 'alreadi':48B 'attack':46B 'code':54B 'condit':40B 'detail':63B 'exact':66B 'flaw':67B 'give':60B 'higher':56B 'infrastructur':33B 'instal':37B,43B 'let':44B 'local':51B 'privileg':57B 'race':39B 'run':53B 'sourc':59B 'window':34B,36B,42B 'windows-instal':35B","search_c":"'allow':81C 'attack':84C 'author':83C 'concurr':68C 'condit':77C 'elev':86C 'execut':69C 'improp':74C 'instal':80C 'local':88C 'privileg':87C 'race':76C 'resourc':72C 'share':71C 'synchron':75C 'use':70C 'window':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96019","severity":null,"published_at":"2026-11-10T19:21:58+00:00","modified_at":"2026-11-10T19:21:58+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","fetched_at":"2026-11-10T19:25:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96019:2613","url":"https://radar.offseq.com/threat/cve-2026-96019-cwe-362-race-condition-in-microsoft-windows-10-version-1607-1eb38a8bb1566ac8","severity":null,"published_at":"2026-11-10T20:10:26+00:00","modified_at":"2026-11-10T20:10:26+00:00","first_seen_at":"2026-11-10T20:10:26+00:00","fetched_at":"2026-11-10T20:10:26+00:00","note":"MSRC page is JS-only and returned nothing, so no primary doc linked and nothing marked verified. Affected/fixed builds are from the OffSeq CVE-record mirror (CNA Microsoft, CVSS 7.0 AC:H PR:L, no exploitation or PoC known as of Nov 10). The mirror's '+8' suggests more builds than the 5 products listed; revisit against MSRC.","cites":["https://radar.offseq.com/threat/cve-2026-96019-cwe-362-race-condition-in-microsoft-windows-10-version-1607-1eb38a8bb1566ac8"]}],"documents":[{"id":117780,"url":"https://radar.offseq.com/threat/cve-2026-96019-cwe-362-race-condition-in-microsoft-windows-10-version-1607-1eb38a8bb1566ac8","title":"OffSeq Threat Radar: CVE-2026-96019 (mirror of CVE record data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}