{"id":"CVE-2026-96060","kind":"vulnerability","aliases":["CVE-2026-96060"],"related":[],"title":"Windows Installer: out-of-bounds read lets a local user gain higher privileges","description":"Out-of-bounds read in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"A flaw in the Windows Installer lets an attacker who already has a local account read memory outside a buffer and raise their privileges. The sources give no further detail on the trigger or exploitation status.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows","windows-installer"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"- Look up CVE-2026-96060 in Microsoft's Security Update Guide, find the KB for your Windows version, and compare it with installed updates (PowerShell: Get-HotFix, or winver for the build).\n- Affected builds and the fixed KB are not yet confirmed from a vendor page; treat all supported Windows versions as possibly affected until you check.","fix":null,"status":"open","published_at":"2026-11-10T19:22:03+00:00","first_seen_at":"2026-11-10T19:25:29+00:00","triaged_at":"2026-11-10T19:36:37+00:00","updated_at":"2026-11-10T19:58:05+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:36:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Installer: out-of-bounds read lets a local user gain higher privileges","impact":"high","summary":"A flaw in the Windows Installer lets an attacker who already has a local account read memory outside a buffer and raise their privileges. The sources give no further detail on the trigger or exploitation status.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-installer","local-privilege-escalation"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Confirm affected Windows builds and the patched KB from Microsoft's CVE-2026-96060 advisory; the NVD entry alone gives no versions or fix.","how_to_check":"- Check the Windows build with `winver` and compare it against the update listed in Microsoft's security guidance for CVE-2026-96060.\n- Run `msiexec /?` to confirm the Windows Installer service is present; the sources do not name a setting that disables the flaw.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Any Windows machine with the Windows Installer component where an authorized user can run code locally is potentially exposed. The sources do not say which Windows versions or configurations are affected, so the vendor's advisory is needed to confirm scope. Systems where only trusted administrators log in are lower risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4484,"output_tokens":564,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Windows builds and the patched KB from Microsoft's CVE-2026-96060 advisory; the NVD entry alone gives no versions or fix.","search":"'-2026':16A,19A '-96060':17A,20A 'account':44B 'allow':74C 'alreadi':40B 'attack':38B,77C 'author':76C 'bound':6A,69C 'buffer':49B 'cve':15A,18A 'detail':59B 'elev':79C 'escal':25B 'exploit':64B 'flaw':31B 'gain':12A 'give':56B 'higher':13A 'infrastructur':21B 'instal':2A,29B,35B,73C 'let':8A,36B 'local':10A,23B,43B,81C 'local-privilege-escal':22B 'memori':46B 'out-of-bound':3A,66C 'outsid':47B 'privileg':14A,24B,53B,80C 'rais':51B 'read':7A,45B,70C 'sourc':55B 'status':65B 'trigger':62B 'user':11A 'window':1A,26B,28B,34B,72C 'windows-instal':27B","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine with the Windows Installer component where an authorized user can run code locally is potentially exposed. The sources do not say which Windows versions or configurations are affected, so the vendor's advisory is needed to confirm scope. Systems where only trusted administrators log in are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","windows","windowsinstaller"],"campaign_type":null,"search_a":"'-2026':16A,19A '-96060':17A,20A 'bound':6A 'cve':15A,18A 'gain':12A 'higher':13A 'instal':2A 'let':8A 'local':10A 'out-of-bound':3A 'privileg':14A 'read':7A 'user':11A 'window':1A","search_b":"'account':44B 'alreadi':40B 'attack':38B 'buffer':49B 'detail':59B 'escal':25B 'exploit':64B 'flaw':31B 'give':56B 'infrastructur':21B 'instal':29B,35B 'let':36B 'local':23B,43B 'local-privilege-escal':22B 'memori':46B 'outsid':47B 'privileg':24B,53B 'rais':51B 'read':45B 'sourc':55B 'status':65B 'trigger':62B 'window':26B,28B,34B 'windows-instal':27B","search_c":"'allow':74C 'attack':77C 'author':76C 'bound':69C 'elev':79C 'instal':73C 'local':81C 'out-of-bound':66C 'privileg':80C 'read':70C 'window':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96060","severity":null,"published_at":"2026-11-10T19:22:03+00:00","modified_at":"2026-11-10T19:22:04+00:00","first_seen_at":"2026-11-10T19:25:29+00:00","fetched_at":"2026-11-10T19:25:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96060:2585","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96060","severity":null,"published_at":"2026-11-10T19:58:05+00:00","modified_at":"2026-11-10T19:58:05+00:00","first_seen_at":"2026-11-10T19:58:05+00:00","fetched_at":"2026-11-10T19:58:05+00:00","note":"Could not read Microsoft's MSRC advisory (JS-only page; web-cli and WebFetch returned nothing; CVRF feed too large). Only NVD linked (CVSS 7.8, AV:L/PR:L, by Microsoft). No affected builds, KB or exploitation info confirmed; nothing verified. Revisit when MSRC/Patch Tuesday data is readable (browser-cli or CVRF with a filter). X and discussion search not run.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-96060"]}],"documents":[{"id":117721,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96060","title":"NVD CVE-2026-96060","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}