{"id":"CVE-2026-96028","kind":"vulnerability","aliases":["CVE-2026-96028"],"related":[],"title":"Windows Installer: type confusion lets a local user gain higher privileges","description":"Access of resource using incompatible type ('type confusion') in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Windows Installer mishandles a resource of an incompatible type, so an attacker with a local account can raise their privileges. The sources give no further detail on the exact trigger.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","local-privilege-escalation","windows","windows-installer"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":"- Open the Microsoft Security Update Guide entry for CVE-2026-96028, find your Windows version in the table and note the KB listed.\n- Run winver (or PowerShell Get-HotFix) and check that this KB, or a later cumulative update, is installed.\n- Windows Update history should show the November 2026 (2026-11-10) cumulative update.","fix":null,"status":"open","published_at":"2026-11-10T19:21:59+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","triaged_at":"2026-11-10T19:36:51+00:00","updated_at":"2026-11-10T20:05:37+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:36:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Installer: type confusion lets a local user gain higher privileges","impact":"high","summary":"Windows Installer mishandles a resource of an incompatible type, so an attacker with a local account can raise their privileges. The sources give no further detail on the exact trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-installer","endpoints"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains administrator or SYSTEM privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide for CVE-2026-96028 for affected Windows builds and the patch KB.","how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update guide entry for CVE-2026-96028\n- unknown otherwise","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Any Windows machine with Windows Installer where an authorized user can run code locally is potentially exposed. Systems where only trusted administrators log in are at lower risk. The sources do not list affected Windows versions.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000685,"input_tokens":4495,"output_tokens":471,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide for CVE-2026-96028 for affected Windows builds and the patch KB.","search":"'-2026':13A,16A '-96028':14A,17A 'access':58C 'account':43B 'allow':69C 'attack':39B,72C 'author':71C 'confus':4A,65C 'cve':12A,15A 'detail':53B 'elev':74C 'endpoint':18B 'escal':23B 'exact':56B 'gain':9A 'give':50B 'higher':10A 'incompat':35B,62C 'infrastructur':19B 'instal':2A,27B,29B,68C 'let':5A 'local':7A,21B,42B,76C 'local-privilege-escal':20B 'mishandl':30B 'privileg':11A,22B,47B,75C 'rais':45B 'resourc':32B,60C 'sourc':49B 'trigger':57B 'type':3A,36B,63C,64C 'use':61C 'user':8A 'window':1A,24B,26B,28B,67C 'windows-instal':25B","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine with Windows Installer where an authorized user can run code locally is potentially exposed. Systems where only trusted administrators log in are at lower risk. The sources do not list affected Windows versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["endpoints","high","infrastructure","localprivilegeescalation","windows","windowsinstaller"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96028':14A,17A 'confus':4A 'cve':12A,15A 'gain':9A 'higher':10A 'instal':2A 'let':5A 'local':7A 'privileg':11A 'type':3A 'user':8A 'window':1A","search_b":"'account':43B 'attack':39B 'detail':53B 'endpoint':18B 'escal':23B 'exact':56B 'give':50B 'incompat':35B 'infrastructur':19B 'instal':27B,29B 'local':21B,42B 'local-privilege-escal':20B 'mishandl':30B 'privileg':22B,47B 'rais':45B 'resourc':32B 'sourc':49B 'trigger':57B 'type':36B 'window':24B,26B,28B 'windows-instal':25B","search_c":"'access':58C 'allow':69C 'attack':72C 'author':71C 'confus':65C 'elev':74C 'incompat':62C 'instal':68C 'local':76C 'privileg':75C 'resourc':60C 'type':63C,64C 'use':61C 'window':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96028","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96028","severity":null,"published_at":"2026-11-10T19:21:59+00:00","modified_at":"2026-11-10T19:21:59+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","fetched_at":"2026-11-10T19:25:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96028:2606","url":null,"severity":null,"published_at":"2026-11-10T20:05:37+00:00","modified_at":"2026-11-10T20:05:37+00:00","first_seen_at":"2026-11-10T20:05:37+00:00","fetched_at":"2026-11-10T20:05:37+00:00","note":"Could not read MSRC entry (JS page empty; CVRF Nov 2026 doc over 10 MB limit). No affected builds, KBs or exploitation status confirmed; nothing verified. Settle by opening the Security Update Guide page for CVE-2026-96028 or the CVRF doc and reading Product/KB table. NVD only, CVSS 7.8 local, PR:L."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}