---
id: "CVE-2026-96061"
page: "https://infrastack.ai/live/CVE-2026-96061"
kind: "vulnerability"
aliases: ["CVE-2026-96061"]
title: "Windows Installer: use-after-free lets a local user gain higher privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Installer", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": "10.0.26100.0 - < 10.0.26100.9974", "ecosystem": "vendor"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": ">= 10.0.19045.0, < 10.0.19045.7846", "ecosystem": "vendor"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": ">= 10.0.20348.0, < 10.0.20348.5870", "ecosystem": "vendor"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": ">= 10.0.26100.0, < 10.0.26100.33822", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "local-privilege-escalation", "use-after-free", "windows", "windows-installer"]
not_affected_if: ["patched-build"]
published_at: "2026-11-10T19:22:04+00:00"
first_seen_at: "2026-11-10T19:25:29+00:00"
updated_at: "2026-11-10T19:56:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96061", "first_seen_at": "2026-11-10T19:25:29+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96061", "first_seen_at": "2026-11-10T19:56:54+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-96061"]}]
exploit_sources: []
---

# Windows Installer: use-after-free lets a local user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-96061 (this .md is for agents)

Use-after-free in Windows Installer (CWE-416) lets an authorized local user elevate privileges. Microsoft rates it CVSS 7.0 High (AV:L/AC:H/PR:L). Affects Windows 10 1607 to 22H2, Windows 11 23H2 to 26H2 and Windows Server 2016 to 2025 below the fixed builds.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Installer affected range not listed fixed no fixed version listed
- vendor:Windows 11 24H2 affected 10.0.26100.0 - < 10.0.26100.9974 fixed 10.0.26100.9974
- vendor:Windows 10 22H2 affected >= 10.0.19045.0, < 10.0.19045.7846 fixed 10.0.19045.7846
- vendor:Windows Server 2022 affected >= 10.0.20348.0, < 10.0.20348.5870 fixed 10.0.20348.5870
- vendor:Windows Server 2025 affected >= 10.0.26100.0, < 10.0.26100.33822 fixed 10.0.26100.33822

## How to check

Run winver or [System.Environment]::OSVersion.Version in PowerShell and compare the full build number (e.g. 10.0.26100.xxxx) with the fixed build for your Windows version; lower means exposed.

## Fix

Install the November 2026 Windows cumulative update that brings your build to at least the fixed build listed per version (e.g. Windows 11 24H2 10.0.26100.9974, Windows 10 22H2 10.0.19045.7846, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822). KB numbers unknown; confirm in MSRC.

## Timeline

- 2026-11-10T19:25:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96061
- 2026-11-10T19:56:54+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-96061 — NVD (Microsoft CNA data) gives affected build ranges; MSRC page not readable by tools, so nothing marked verified. No exploitation or PoC seen.

## Documents

- [describes] NVD CVE-2026-96061 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/CVE-2026-96061

## From the sources

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_