{"id":"CVE-2026-96031","kind":"vulnerability","aliases":["CVE-2026-96031"],"related":[],"title":"Windows kernel: out-of-bounds write lets a local user gain admin rights","description":"Out-of-bounds write in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"Microsoft rates this Windows kernel flaw Important (CVSS 7.8). An out-of-bounds write lets someone who already has a local account gain higher privileges. Microsoft says it is not exploited or publicly disclosed. Affected builds and the fixing update were not retrievable, so they are unknown.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","windows","windows-kernel"],"not_affected_if":["no-untrusted-local-users","single-user-machine"],"how_to_check":"Run winver (or Get-ComputerInfo) for your build, then open Microsoft's Security Update Guide entry for CVE-2026-96031 and compare it with the KB listed for your Windows version. Affected builds and KB were not available when this was written.","fix":null,"status":"open","published_at":"2026-11-10T19:21:59+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","triaged_at":"2026-11-10T19:36:48+00:00","updated_at":"2026-11-10T20:04:51+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:36:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows kernel: out-of-bounds write lets a local user gain admin rights","impact":"high","summary":"A memory write past the end of a buffer in the Windows kernel lets an attacker who already has a local account raise their privileges. The sources give no detail beyond that, so the exact trigger is unknown.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-kernel"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level control of the machine","analyst_note":"Find affected Windows builds and the patch from Microsoft's Security Update Guide entry for CVE-2026-96031; NVD gives no ranges.","how_to_check":"- Run `winver` on Windows and compare the build against Microsoft's security update guide entry for CVE-2026-96031\n- unknown beyond that, the sources do not say","plain_action":"","product_name":"Windows Kernel","needs_analyst":true,"not_affected_if":["single-user-machine","no-untrusted-local-users"],"who_is_affected":"Windows machines where untrusted or low-privilege users can run code locally, such as shared servers, terminal servers and multi-user workstations. The sources do not name affected Windows builds, so check Microsoft's advisory for the exact range. Systems where only administrators log in are lower risk.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4486,"output_tokens":545,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Windows builds and the patch from Microsoft's Security Update Guide entry for CVE-2026-96031; NVD gives no ranges.","search":"'-2026':16A,19A '-96031':17A,20A '7.8':36B 'account':50B 'admin':13A 'affect':63B 'allow':84C 'alreadi':46B 'attack':87C 'author':86C 'bound':6A,41B,79C 'build':64B 'cve':15A,18A 'cvss':35B 'disclos':62B 'elev':89C 'exploit':59B 'fix':67B 'flaw':33B 'gain':12A,51B 'higher':52B 'import':34B 'infrastructur':23B 'kernel':2A,22A,27B,32B,83C 'let':8A,43B 'local':10A,49B,91C 'microsoft':28B,54B 'out-of-bound':3A,38B,76C 'privileg':53B,90C 'public':61B 'rate':29B 'retriev':71B 'right':14A 'say':55B 'someon':44B 'unknown':75B 'updat':68B 'user':11A 'window':1A,24B,26B,31B,82C 'windows':21A 'windows-kernel':25B 'write':7A,42B,80C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where untrusted or low-privilege users can run code locally, such as shared servers, terminal servers and multi-user workstations. The sources do not name affected Windows builds, so check Microsoft's advisory for the exact range. Systems where only administrators log in are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["kernel","windowskernel"],"ptokens":["kernel","windows"],"labels":["high","infrastructure","vendor","windows","windowskernel"],"campaign_type":null,"search_a":"'-2026':16A,19A '-96031':17A,20A 'admin':13A 'bound':6A 'cve':15A,18A 'gain':12A 'kernel':2A,22A 'let':8A 'local':10A 'out-of-bound':3A 'right':14A 'user':11A 'window':1A 'windows':21A 'write':7A","search_b":"'7.8':36B 'account':50B 'affect':63B 'alreadi':46B 'bound':41B 'build':64B 'cvss':35B 'disclos':62B 'exploit':59B 'fix':67B 'flaw':33B 'gain':51B 'higher':52B 'import':34B 'infrastructur':23B 'kernel':27B,32B 'let':43B 'local':49B 'microsoft':28B,54B 'out-of-bound':38B 'privileg':53B 'public':61B 'rate':29B 'retriev':71B 'say':55B 'someon':44B 'unknown':75B 'updat':68B 'window':24B,26B,31B 'windows-kernel':25B 'write':42B","search_c":"'allow':84C 'attack':87C 'author':86C 'bound':79C 'elev':89C 'kernel':83C 'local':91C 'out-of-bound':76C 'privileg':90C 'window':82C 'write':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96031","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96031","severity":null,"published_at":"2026-11-10T19:21:59+00:00","modified_at":"2026-11-10T19:22:00+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","fetched_at":"2026-11-10T19:25:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96031:2603","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-96031","severity":null,"published_at":"2026-11-10T20:04:30+00:00","modified_at":"2026-11-10T20:04:51+00:00","first_seen_at":"2026-11-10T20:04:30+00:00","fetched_at":"2026-11-10T20:04:51+00:00","note":"MSRC record (sug API) read: Windows Kernel EoP, OOB write, local, CVSS 7.8 Important, E:U, not exploited, not publicly disclosed. Affected builds/KB/fix absent from the record I could retrieve; left unknown. Need the full MSRC page (JS-only; browser-cli 402, web-cli empty).","cites":["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-96031"]}],"documents":[{"id":117749,"url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-96031","title":"MSRC: Windows Kernel Elevation of Privilege Vulnerability CVE-2026-96031","kind":"advisory","source":"analyst","publisher":null,"text":"Microsoft record: Windows Kernel Elevation of Privilege; out-of-bounds write allows an authorized attacker to elevate privileges locally. CVSS 3.1 7.8 Important (AV:L/AC:L/PR:L/UI:N), temporal 6.8, E:U RL:O RC:C. Exploited: No. Publicly disclosed: No. Affected builds, KB and fixed build not in the record as retrieved.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}