{"id":"CVE-2026-96046","kind":"vulnerability","aliases":["CVE-2026-96046"],"related":[],"title":"Windows Installer: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"A memory-handling bug in Windows Installer lets a user who already has an account on the machine raise their privileges. The attacker gets elevated rights locally, not remote access.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows","windows-installer"],"not_affected_if":["no-local-users"],"how_to_check":"Unknown until the MSRC entry for CVE-2026-96046 lists affected builds and the KB. Check installed Windows build (winver) and update history against that KB once published.","fix":null,"status":"open","published_at":"2026-11-10T19:22:01+00:00","first_seen_at":"2026-11-10T19:25:28+00:00","triaged_at":"2026-11-10T19:49:29+00:00","updated_at":"2026-11-10T20:02:24+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:49:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Installer: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A memory-handling bug in Windows Installer lets a user who already has an account on the machine raise their privileges. The attacker gets elevated rights locally, not remote access.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-installer"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-96046 for affected Windows builds, the patch KB and any mitigation.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Windows machines with the Windows Installer service are in scope, and the risk is limited to someone who can already log on locally. The sources do not list affected Windows builds or whether a patch is out, so unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000654,"input_tokens":4474,"output_tokens":414,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-96046 for affected Windows builds, the patch KB and any mitigation.","search":"'-2026':15A,18A '-96046':16A,19A 'access':59B 'account':44B 'allow':66C 'alreadi':41B 'attack':52B,69C 'author':68C 'bug':33B 'cve':14A,17A 'elev':54B,71C 'escal':24B 'free':6A,62C 'gain':11A 'get':53B 'handl':32B 'higher':12A 'infrastructur':20B 'instal':2A,28B,36B,65C 'let':7A,37B 'local':9A,22B,56B,73C 'local-privilege-escal':21B 'machin':47B 'memori':31B 'memory-handl':30B 'privileg':13A,23B,50B,72C 'rais':48B 'remot':58B 'right':55B 'use':4A,60C 'use-after-fre':3A 'user':10A,39B 'window':1A,25B,27B,35B,64C 'windows-instal':26B","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the Windows Installer service are in scope, and the risk is limited to someone who can already log on locally. The sources do not list affected Windows builds or whether a patch is out, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","windows","windowsinstaller"],"campaign_type":null,"search_a":"'-2026':15A,18A '-96046':16A,19A 'cve':14A,17A 'free':6A 'gain':11A 'higher':12A 'instal':2A 'let':7A 'local':9A 'privileg':13A 'use':4A 'use-after-fre':3A 'user':10A 'window':1A","search_b":"'access':59B 'account':44B 'alreadi':41B 'attack':52B 'bug':33B 'elev':54B 'escal':24B 'get':53B 'handl':32B 'infrastructur':20B 'instal':28B,36B 'let':37B 'local':22B,56B 'local-privilege-escal':21B 'machin':47B 'memori':31B 'memory-handl':30B 'privileg':23B,50B 'rais':48B 'remot':58B 'right':55B 'user':39B 'window':25B,27B,35B 'windows-instal':26B","search_c":"'allow':66C 'attack':69C 'author':68C 'elev':71C 'free':62C 'instal':65C 'local':73C 'privileg':72C 'use':60C 'window':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96046","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96046","severity":null,"published_at":"2026-11-10T19:22:01+00:00","modified_at":"2026-11-10T19:22:01+00:00","first_seen_at":"2026-11-10T19:25:28+00:00","fetched_at":"2026-11-10T19:25:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96046:2596","url":null,"severity":null,"published_at":"2026-11-10T20:02:24+00:00","modified_at":"2026-11-10T20:02:24+00:00","first_seen_at":"2026-11-10T20:02:24+00:00","fetched_at":"2026-11-10T20:02:24+00:00","note":"MSRC page is JS-only; web-cli/WebFetch returned nothing for it, and no search result covers this CVE (hits were sibling CVEs 70346/70347). No affected builds, KB or mitigation read from a primary source, so nothing is verified. Needs the MSRC entry read in a browser, or a revisit once NVD lists CPEs. NVD: CVSS 7.0 AV:L/AC:H/PR:L, no exploitation or PoC known. X not checked."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}