{"id":"CVE-2026-96035","kind":"vulnerability","aliases":["CVE-2026-96035"],"related":[],"title":"Windows Installer: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Windows Installer has a use-after-free memory bug that lets an attacker who already has a local account raise their privileges. The attacker gets elevated rights on the same Windows machine.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"10.0.19045.0 - < 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"10.0.26100.0 - < 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"10.0.26200.0 - < 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"10.0.20348.0 - < 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"10.0.26100.0 - < 10.0.26100.33822","ecosystem":"microsoft"},{"name":"Windows Server 2019","fixed":["10.0.17763.9487"],"affected":"10.0.17763.0 - < 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows Server 2016","fixed":["10.0.14393.9688"],"affected":"10.0.14393.0 - < 10.0.14393.9688","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows","windows-installer"],"not_affected_if":["no-untrusted-local-users","single-user-machines"],"how_to_check":"Run winver (or [System.Environment]::OSVersion.Version / cmd 'ver') and compare the full build.revision with the fixed builds in the fix field; lower means exposed. Matters most on shared machines, terminal servers, and CI hosts with several local users.","fix":"Install the November 2026 cumulative update that brings the build to at least: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2/22H2 10.0.19044.7846 / 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. KB numbers: see the MSRC entry.","status":"open","published_at":"2026-11-10T19:22:00+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","triaged_at":"2026-11-10T19:49:32+00:00","updated_at":"2026-11-10T20:04:42+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:49:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Installer: use-after-free lets a local user gain higher privileges","impact":"high","summary":"Windows Installer has a use-after-free memory bug that lets an attacker who already has a local account raise their privileges. The attacker gets elevated rights on the same Windows machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-installer"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find affected Windows builds and the patch in the Microsoft Security Update Guide entry for CVE-2026-96035.","how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update guide entry for CVE-2026-96035\n- Confirm Windows Update has installed the latest cumulative update","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-user-machines","no-untrusted-local-users"],"who_is_affected":"Anyone with a local, authorized account on a Windows machine could exploit this to elevate privileges. Servers and workstations with multiple local users or shared machines are the most relevant. The sources do not name the affected Windows versions or the patch.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000695,"input_tokens":4474,"output_tokens":496,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Windows builds and the patch in the Microsoft Security Update Guide entry for CVE-2026-96035.","search":"'-2026':15A,18A '-96035':16A,19A '10':21A '11':24A,27A '2016':40A '2019':37A '2022':31A '2025':34A '22h2':22A '24h2':25A '25h2':28A 'account':69B 'allow':89C 'alreadi':65B 'attack':63B,74B,92C 'author':91C 'bug':59B 'cve':14A,17A 'elev':76B,94C 'escal':45B 'free':6A,57B,85C 'gain':11A 'get':75B 'higher':12A 'infrastructur':41B 'instal':2A,49B,51B,88C 'let':7A,61B 'local':9A,43B,68B,96C 'local-privilege-escal':42B 'machin':82B 'memori':58B 'privileg':13A,44B,72B,95C 'rais':70B 'right':77B 'server':30A,33A,36A,39A 'use':4A,55B,83C 'use-after-fre':3A,54B 'user':10A 'window':1A,46B,48B,50B,81B,87C 'windows':20A,23A,26A,29A,32A,35A,38A 'windows-instal':47B","nicknames":[],"mitigations":[],"who_affected":"Windows machines where someone other than the admin can log in locally or run code (shared workstations, terminal/RDP servers, build agents, dev boxes running untrusted code). Exploitation needs a low-privileged local account and is rated high complexity (CVSS 7.0, AV:L/AC:H). Single-user machines with no untrusted code carry little added risk but should still update.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1022h2","1124h2","1125h2","server2016","server2019","server2022","server2025","windows1022h2","windows1124h2","windows1125h2","windowsserver2016","windowsserver2019","windowsserver2022","windowsserver2025"],"ptokens":["10","11","2016","2019","2022","2025","22h2","24h2","25h2","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","windows","windowsinstaller"],"campaign_type":null,"search_a":"'-2026':15A,18A '-96035':16A,19A '10':21A '11':24A,27A '2016':40A '2019':37A '2022':31A '2025':34A '22h2':22A '24h2':25A '25h2':28A 'cve':14A,17A 'free':6A 'gain':11A 'higher':12A 'instal':2A 'let':7A 'local':9A 'privileg':13A 'server':30A,33A,36A,39A 'use':4A 'use-after-fre':3A 'user':10A 'window':1A 'windows':20A,23A,26A,29A,32A,35A,38A","search_b":"'account':69B 'alreadi':65B 'attack':63B,74B 'bug':59B 'elev':76B 'escal':45B 'free':57B 'get':75B 'infrastructur':41B 'instal':49B,51B 'let':61B 'local':43B,68B 'local-privilege-escal':42B 'machin':82B 'memori':58B 'privileg':44B,72B 'rais':70B 'right':77B 'use':55B 'use-after-fre':54B 'window':46B,48B,50B,81B 'windows-instal':47B","search_c":"'allow':89C 'attack':92C 'author':91C 'elev':94C 'free':85C 'instal':88C 'local':96C 'privileg':95C 'use':83C 'window':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96035","severity":null,"published_at":"2026-11-10T19:22:00+00:00","modified_at":"2026-11-10T19:22:00+00:00","first_seen_at":"2026-11-10T19:25:27+00:00","fetched_at":"2026-11-10T19:25:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96035:2602","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96035","severity":null,"published_at":"2026-11-10T20:04:42+00:00","modified_at":"2026-11-10T20:04:42+00:00","first_seen_at":"2026-11-10T20:04:42+00:00","fetched_at":"2026-11-10T20:04:42+00:00","note":"MSRC page is JS-only and unreadable; builds taken from NVD's Microsoft-CNA affected list (not the MSRC page), so nothing marked verified. KB numbers unknown; no exploitation or PoC seen.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-96035"]}],"documents":[{"id":117748,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96035","title":"NVD CVE-2026-96035 (Microsoft CNA affected builds)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}