{"id":"CVE-2026-96026","kind":"vulnerability","aliases":["CVE-2026-96026"],"related":[],"title":"Windows Installer: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in Windows Installer lets a logged-in local user raise their privileges. The attacker needs valid access to the machine first.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows","windows-installer"],"not_affected_if":[],"how_to_check":"Unknown: MSRC advisory not read. Once known, compare installed Windows build (winver) against the fixed build in the MSRC Security Update Guide entry for CVE-2026-96026.","fix":null,"status":"open","published_at":"2026-11-10T19:21:59+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","triaged_at":"2026-11-10T19:49:34+00:00","updated_at":"2026-11-10T20:05:54+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:49:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Installer: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in Windows Installer lets a logged-in local user raise their privileges. The attacker needs valid access to the machine first.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-installer"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-96026 for affected Windows builds, patch status and a fixed build.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines with the Windows Installer component are the systems in scope, according to the description given. The sources give no further detail on configuration or affected Windows builds, so unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000642,"input_tokens":4474,"output_tokens":389,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-96026 for affected Windows builds, patch status and a fixed build.","search":"'-2026':15A,18A '-96026':16A,19A 'access':52B 'allow':63C 'attack':49B,66C 'author':65C 'bug':34B 'cve':14A,17A 'elev':68C 'escal':24B 'first':56B 'free':6A,33B,59C 'gain':11A 'higher':12A 'infrastructur':20B 'instal':2A,28B,37B,62C 'let':7A,38B 'local':9A,22B,43B,70C 'local-privilege-escal':21B 'log':41B 'logged-in':40B 'machin':55B 'need':50B 'privileg':13A,23B,47B,69C 'rais':45B 'use':4A,31B,57C 'use-after-fre':3A,30B 'user':10A,44B 'valid':51B 'window':1A,25B,27B,36B,61C 'windows-instal':26B","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the Windows Installer component are the systems in scope, according to the description given. The sources give no further detail on configuration or affected Windows builds, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","windows","windowsinstaller"],"campaign_type":null,"search_a":"'-2026':15A,18A '-96026':16A,19A 'cve':14A,17A 'free':6A 'gain':11A 'higher':12A 'instal':2A 'let':7A 'local':9A 'privileg':13A 'use':4A 'use-after-fre':3A 'user':10A 'window':1A","search_b":"'access':52B 'attack':49B 'bug':34B 'escal':24B 'first':56B 'free':33B 'infrastructur':20B 'instal':28B,37B 'let':38B 'local':22B,43B 'local-privilege-escal':21B 'log':41B 'logged-in':40B 'machin':55B 'need':50B 'privileg':23B,47B 'rais':45B 'use':31B 'use-after-fre':30B 'user':44B 'valid':51B 'window':25B,27B,36B 'windows-instal':26B","search_c":"'allow':63C 'attack':66C 'author':65C 'elev':68C 'free':59C 'instal':62C 'local':70C 'privileg':69C 'use':57C 'window':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96026","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96026","severity":null,"published_at":"2026-11-10T19:21:59+00:00","modified_at":"2026-11-10T19:21:59+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","fetched_at":"2026-11-10T19:25:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96026:2608","url":null,"severity":null,"published_at":"2026-11-10T20:05:54+00:00","modified_at":"2026-11-10T20:05:54+00:00","first_seen_at":"2026-11-10T20:05:54+00:00","fetched_at":"2026-11-10T20:05:54+00:00","note":"Could not read MSRC advisory (update-guide page is JS-only, web-cli empty, browser quota exhausted). Only NVD description known; builds, KB and fix unknown. Revisit once MSRC/CVRF content is reachable; fix is presumably in November 2026 Patch Tuesday but unconfirmed."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}