{"id":"CVE-2026-96023","kind":"vulnerability","aliases":["CVE-2026-96023"],"related":[],"title":"Windows: use-after-free in push notification core lets a local user gain privileges","description":"Use after free in Windows Push Notification Core allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in the Windows Push Notification Core component lets an attacker who already has a local, authorized account raise their privileges. The sources give no further technical detail.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Push Notification Core","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local-privilege-escalation","windows"],"not_affected_if":["patched-nov-2026"],"how_to_check":"Check that the November 2026 (2026-11-10) cumulative update is installed: Settings > Windows Update > Update history. Per-build KB numbers still need the MSRC page.","fix":"Install the November 2026 Windows cumulative update (released 2026-11-10); the exact KB per Windows version is unconfirmed","status":"open","published_at":"2026-11-10T19:21:58+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","triaged_at":"2026-11-10T19:36:51+00:00","updated_at":"2026-11-10T20:08:16+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:36:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: use-after-free in push notification core lets a local user gain privileges","impact":"high","summary":"A use-after-free bug in the Windows Push Notification Core component lets an attacker who already has a local, authorized account raise their privileges. The sources give no further technical detail.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the machine","analyst_note":"Find Microsoft's advisory for CVE-2026-96023 to confirm affected Windows builds and the fixed update.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Push Notification Core","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines with the Push Notification Core component are the affected systems; an attacker needs a local account first. The sources do not name affected Windows builds or the fixing update, so unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":4482,"output_tokens":417,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Microsoft's advisory for CVE-2026-96023 to confirm affected Windows builds and the fixed update.","search":"'-2026':17A,20A '-96023':18A,21A 'account':54B 'allow':73C 'alreadi':49B 'attack':47B,76C 'author':53B,75C 'bug':37B 'compon':44B 'core':9A,25A,43B,72C 'cve':16A,19A 'detail':64B 'elev':78C 'escal':30B 'free':5A,36B,67C 'gain':14A 'give':60B 'infrastructur':26B 'let':10A,45B 'local':12A,28B,52B,80C 'local-privilege-escal':27B 'notif':8A,42B,71C 'notification':24A 'privileg':15A,29B,57B,79C 'push':7A,23A,41B,70C 'rais':55B 'sourc':59B 'technic':63B 'use':3A,34B,65C 'use-after-fre':2A,33B 'user':13A 'window':1A,31B,40B,69C 'windows':22A","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the Push Notification Core component are the affected systems; an attacker needs a local account first. The sources do not name affected Windows builds or the fixing update, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["pushnotificationcore","windowspushnotificationcore"],"ptokens":["core","notification","push","windows"],"labels":["high","infrastructure","localprivilegeescalation","vendor","windows"],"campaign_type":null,"search_a":"'-2026':17A,20A '-96023':18A,21A 'core':9A,25A 'cve':16A,19A 'free':5A 'gain':14A 'let':10A 'local':12A 'notif':8A 'notification':24A 'privileg':15A 'push':7A,23A 'use':3A 'use-after-fre':2A 'user':13A 'window':1A 'windows':22A","search_b":"'account':54B 'alreadi':49B 'attack':47B 'author':53B 'bug':37B 'compon':44B 'core':43B 'detail':64B 'escal':30B 'free':36B 'give':60B 'infrastructur':26B 'let':45B 'local':28B,52B 'local-privilege-escal':27B 'notif':42B 'privileg':29B,57B 'push':41B 'rais':55B 'sourc':59B 'technic':63B 'use':34B 'use-after-fre':33B 'window':31B,40B","search_c":"'allow':73C 'attack':76C 'author':75C 'core':72C 'elev':78C 'free':67C 'local':80C 'notif':71C 'privileg':79C 'push':70C 'use':65C 'window':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96023","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96023","severity":null,"published_at":"2026-11-10T19:21:58+00:00","modified_at":"2026-11-10T19:21:59+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","fetched_at":"2026-11-10T19:25:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96023:2611","url":"https://api.msrc.microsoft.com/cvrf/v3.0/updates/CVE-2026-96023","severity":null,"published_at":"2026-11-10T20:08:16+00:00","modified_at":"2026-11-10T20:08:16+00:00","first_seen_at":"2026-11-10T20:08:16+00:00","fetched_at":"2026-11-10T20:08:16+00:00","note":"MSRC API index puts this CVE in the November 2026 Patch Tuesday release (2026-11-10). The advisory page is JS-only and the CVRF document came back empty, so affected builds, KBs and the fix are not confirmed. Nothing verified. Do not confuse with CVE-2026-69280 (Windows Push Notifications EoP, Sep 2026).","cites":["https://api.msrc.microsoft.com/cvrf/v3.0/updates/CVE-2026-96023"]}],"documents":[{"id":117776,"url":"https://api.msrc.microsoft.com/cvrf/v3.0/updates/CVE-2026-96023","title":"MSRC CVRF index: CVE-2026-96023 is in the November 2026 Security Updates","kind":"advisory","source":"analyst","publisher":null,"text":"MSRC API lists CVE-2026-96023 under 2026-Nov (November 2026 Security Updates), released 2026-11-10. No affected builds or KB numbers in this index entry.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}