{"id":"CVE-2026-96061","kind":"vulnerability","aliases":["CVE-2026-96061"],"related":[],"title":"Windows Installer: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"Use-after-free in Windows Installer (CWE-416) lets an authorized local user elevate privileges. Microsoft rates it CVSS 7.0 High (AV:L/AC:H/PR:L). Affects Windows 10 1607 to 22H2, Windows 11 23H2 to 26H2 and Windows Server 2016 to 2025 below the fixed builds.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Installer","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"10.0.26100.0 - < 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":">= 10.0.20348.0, < 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local-privilege-escalation","use-after-free","windows","windows-installer"],"not_affected_if":["patched-build"],"how_to_check":"Run winver or [System.Environment]::OSVersion.Version in PowerShell and compare the full build number (e.g. 10.0.26100.xxxx) with the fixed build for your Windows version; lower means exposed.","fix":"Install the November 2026 Windows cumulative update that brings your build to at least the fixed build listed per version (e.g. Windows 11 24H2 10.0.26100.9974, Windows 10 22H2 10.0.19045.7846, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822). KB numbers unknown; confirm in MSRC.","status":"open","published_at":"2026-11-10T19:22:04+00:00","first_seen_at":"2026-11-10T19:25:29+00:00","triaged_at":"2026-11-10T19:49:25+00:00","updated_at":"2026-11-10T19:56:54+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:49:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Installer: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A memory-handling bug in Windows Installer lets an attacker who already has a local account raise their privileges. The sources do not describe the exact trigger or the affected Windows builds.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-installer"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local user gains elevated privileges, such as SYSTEM or administrator rights.","analyst_note":"Check Microsoft's security update guide entry for CVE-2026-96061 for affected Windows builds and the patch.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Installer","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running Windows where Windows Installer is present and local users can log on. The sources do not list affected versions or the exact conditions needed. unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":4474,"output_tokens":420,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Microsoft's security update guide entry for CVE-2026-96061 for affected Windows builds and the patch.","search":"'-2026':15A,18A '-416':55B '-96061':16A,19A '10':26A,75B '11':23A,80B '1607':76B '2016':87B '2022':30A '2025':33A,89B '22h2':27A,78B '23h2':81B '24h2':24A '26h2':83B '7.0':67B 'affect':73B 'allow':100C 'attack':103C 'author':58B,102C 'av':69B 'build':93B 'cve':14A,17A 'cvss':66B 'cwe':54B 'elev':61B,105C 'escal':38B 'fix':92B 'free':6A,42B,50B,96C 'gain':11A 'h/pr':71B 'high':68B 'higher':12A 'infrastructur':34B 'instal':2A,46B,53B,99C 'installer':21A 'l':72B 'l/ac':70B 'let':7A,56B 'local':9A,36B,59B,107C 'local-privilege-escal':35B 'microsoft':63B 'privileg':13A,37B,62B,106C 'rate':64B 'server':29A,32A,86B 'use':4A,40B,48B,94C 'use-after-fre':3A,39B,47B 'user':10A,60B 'window':1A,43B,45B,52B,74B,79B,85B,98C 'windows':20A,22A,25A,28A,31A 'windows-instal':44B","nicknames":[],"mitigations":[],"who_affected":"Systems running Windows where Windows Installer is present and local users can log on. The sources do not list affected versions or the exact conditions needed. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["1022h2","1124h2","installer","server2022","server2025","windows1022h2","windows1124h2","windowsinstaller","windowsserver2022","windowsserver2025"],"ptokens":["10","11","2022","2025","22h2","24h2","installer","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","useafterfree","vendor","windows","windowsinstaller"],"campaign_type":null,"search_a":"'-2026':15A,18A '-96061':16A,19A '10':26A '11':23A '2022':30A '2025':33A '22h2':27A '24h2':24A 'cve':14A,17A 'free':6A 'gain':11A 'higher':12A 'instal':2A 'installer':21A 'let':7A 'local':9A 'privileg':13A 'server':29A,32A 'use':4A 'use-after-fre':3A 'user':10A 'window':1A 'windows':20A,22A,25A,28A,31A","search_b":"'-416':55B '10':75B '11':80B '1607':76B '2016':87B '2025':89B '22h2':78B '23h2':81B '26h2':83B '7.0':67B 'affect':73B 'author':58B 'av':69B 'build':93B 'cvss':66B 'cwe':54B 'elev':61B 'escal':38B 'fix':92B 'free':42B,50B 'h/pr':71B 'high':68B 'infrastructur':34B 'instal':46B,53B 'l':72B 'l/ac':70B 'let':56B 'local':36B,59B 'local-privilege-escal':35B 'microsoft':63B 'privileg':37B,62B 'rate':64B 'server':86B 'use':40B,48B 'use-after-fre':39B,47B 'user':60B 'window':43B,45B,52B,74B,79B,85B 'windows-instal':44B","search_c":"'allow':100C 'attack':103C 'author':102C 'elev':105C 'free':96C 'instal':99C 'local':107C 'privileg':106C 'use':94C 'window':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96061","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96061","severity":null,"published_at":"2026-11-10T19:22:04+00:00","modified_at":"2026-11-10T19:22:04+00:00","first_seen_at":"2026-11-10T19:25:29+00:00","fetched_at":"2026-11-10T19:25:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96061:2584","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96061","severity":null,"published_at":"2026-11-10T19:56:54+00:00","modified_at":"2026-11-10T19:56:54+00:00","first_seen_at":"2026-11-10T19:56:54+00:00","fetched_at":"2026-11-10T19:56:54+00:00","note":"NVD (Microsoft CNA data) gives affected build ranges; MSRC page not readable by tools, so nothing marked verified. No exploitation or PoC seen.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-96061"]}],"documents":[{"id":117719,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96061","title":"NVD CVE-2026-96061 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}