{"id":"CVE-2026-96052","kind":"vulnerability","aliases":["CVE-2026-96052"],"related":[],"title":"Windows Kernel: integer underflow lets a local user gain higher privileges","description":"Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to elevate privileges locally.","summary":"An integer underflow in the Windows kernel lets a user who already has an account on the machine raise their privileges. The attacker gets the rights of a more powerful account, which can mean full control of the system.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows","windows-server"],"not_affected_if":["no-local-accounts"],"how_to_check":"- Check the Windows build with `winver` and compare it against the fixed build in Microsoft's advisory for CVE-2026-96052\n- Confirm the latest cumulative security update is installed with `wmic qfe list` or Settings > Windows Update > Update history","fix":null,"status":"open","published_at":"2026-11-10T19:22:02+00:00","first_seen_at":"2026-11-10T19:25:28+00:00","triaged_at":"2026-11-10T19:36:44+00:00","updated_at":"2026-11-10T20:00:18+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:36:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Kernel: integer underflow lets a local user gain higher privileges","impact":"high","summary":"An integer underflow in the Windows kernel lets a user who already has an account on the machine raise their privileges. The attacker gets the rights of a more powerful account, which can mean full control of the system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level control of the machine","analyst_note":"Find Microsoft's security update guide entry for CVE-2026-96052 to get affected and fixed Windows builds and the patch.","how_to_check":"- Check the Windows build with `winver` and compare it against the fixed build in Microsoft's advisory for CVE-2026-96052\n- Confirm the latest cumulative security update is installed with `wmic qfe list` or Settings > Windows Update > Update history","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-accounts"],"who_is_affected":"Any Windows machine where people or services have a local login can be exposed, since the attacker must already be authorized on the system. Servers and workstations both fall in scope. unknown for the exact affected builds, which the sources do not list.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4500,"output_tokens":504,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Microsoft's security update guide entry for CVE-2026-96052 to get affected and fixed Windows builds and the patch.","search":"'-2026':13A,16A '-96052':14A,17A 'account':41B,57B 'allow':74C 'alreadi':38B 'attack':49B,77C 'author':76C 'control':62B 'cve':12A,15A 'elev':79C 'escal':22B 'full':61B 'gain':9A 'get':50B 'higher':10A 'infrastructur':18B 'integ':3A,28B,66C 'kernel':2A,33B,73C 'let':5A,34B 'local':7A,20B,81C 'local-privilege-escal':19B 'machin':44B 'mean':60B 'power':56B 'privileg':11A,21B,47B,80C 'rais':45B 'right':52B 'server':26B 'system':65B 'underflow':4A,29B,67C 'user':8A,36B 'window':1A,23B,25B,32B,72C 'windows-serv':24B 'wrap':68C 'wraparound':70C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine where people or services have a local login can be exposed, since the attacker must already be authorized on the system. Servers and workstations both fall in scope. unknown for the exact affected builds, which the sources do not list.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","windows","windowsserver"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96052':14A,17A 'cve':12A,15A 'gain':9A 'higher':10A 'integ':3A 'kernel':2A 'let':5A 'local':7A 'privileg':11A 'underflow':4A 'user':8A 'window':1A","search_b":"'account':41B,57B 'alreadi':38B 'attack':49B 'control':62B 'escal':22B 'full':61B 'get':50B 'infrastructur':18B 'integ':28B 'kernel':33B 'let':34B 'local':20B 'local-privilege-escal':19B 'machin':44B 'mean':60B 'power':56B 'privileg':21B,47B 'rais':45B 'right':52B 'server':26B 'system':65B 'underflow':29B 'user':36B 'window':23B,25B,32B 'windows-serv':24B","search_c":"'allow':74C 'attack':77C 'author':76C 'elev':79C 'integ':66C 'kernel':73C 'local':81C 'privileg':80C 'underflow':67C 'window':72C 'wrap':68C 'wraparound':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96052","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96052","severity":null,"published_at":"2026-11-10T19:22:02+00:00","modified_at":"2026-11-10T19:22:02+00:00","first_seen_at":"2026-11-10T19:25:28+00:00","fetched_at":"2026-11-10T19:25:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96052:2592","url":null,"severity":null,"published_at":"2026-11-10T20:00:18+00:00","modified_at":"2026-11-10T20:00:18+00:00","first_seen_at":"2026-11-10T20:00:18+00:00","fetched_at":"2026-11-10T20:00:18+00:00","note":"MSRC, NVD and cve.org pages returned no readable content; no affected builds or KB found. Nothing verified. Revisit once the MSRC entry is indexed. Published on Nov 2026 Patch Tuesday day."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}