{"id":"CVE-2026-96081","kind":"vulnerability","aliases":["CVE-2026-96081"],"related":[],"title":"Windows Rich Text Edit Control: heap overflow lets an attacker run code over network","description":"Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.","summary":"A heap-based buffer overflow in the Windows Rich Text Edit Control lets an unauthorized attacker run code across a network. NVD rates it high, CVSS 7.5.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","rce","rich-text-edit","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:22:06+00:00","first_seen_at":"2026-11-10T19:25:30+00:00","triaged_at":"2026-11-10T19:42:52+00:00","updated_at":"2026-11-10T19:54:05+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-10T19:42:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Rich Text Edit Control: heap overflow lets an attacker run code over network","impact":"high","summary":"A heap-based buffer overflow in the Windows Rich Text Edit Control lets an unauthorized attacker run code across a network. NVD rates it high, CVSS 7.5.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["windows","rich-text-edit"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs code on the machine over the network","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-96081 for affected Windows builds, the fixed update, and whether user interaction is needed.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines with the Rich Text Edit Control in use are the likely exposure; the sources do not say which Windows versions or applications are affected. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000653,"input_tokens":4502,"output_tokens":406,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-96081 for affected Windows builds, the fixed update, and whether user interaction is needed.","search":"'-2026':16A,19A '-96081':17A,20A '7.5':55B 'across':47B 'allow':67C 'attack':10A,44B,70C 'base':31B,58C 'buffer':32B,59C 'code':12A,46B,73C 'control':5A,40B,66C 'cve':15A,18A 'cvss':54B 'edit':4A,26B,39B,65C 'execut':72C 'heap':6A,30B,57C 'heap-bas':29B,56C 'high':53B 'infrastructur':21B 'let':8A,41B 'network':14A,49B,76C 'nvd':50B 'overflow':7A,33B,60C 'rate':51B 'rce':22B 'rich':2A,24B,37B,63C 'rich-text-edit':23B 'run':11A,45B 'text':3A,25B,38B,64C 'unauthor':43B,69C 'window':1A,27B,36B,62C","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the Rich Text Edit Control in use are the likely exposure; the sources do not say which Windows versions or applications are affected. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","rce","richtextedit","windows"],"campaign_type":null,"search_a":"'-2026':16A,19A '-96081':17A,20A 'attack':10A 'code':12A 'control':5A 'cve':15A,18A 'edit':4A 'heap':6A 'let':8A 'network':14A 'overflow':7A 'rich':2A 'run':11A 'text':3A 'window':1A","search_b":"'7.5':55B 'across':47B 'attack':44B 'base':31B 'buffer':32B 'code':46B 'control':40B 'cvss':54B 'edit':26B,39B 'heap':30B 'heap-bas':29B 'high':53B 'infrastructur':21B 'let':41B 'network':49B 'nvd':50B 'overflow':33B 'rate':51B 'rce':22B 'rich':24B,37B 'rich-text-edit':23B 'run':45B 'text':25B,38B 'unauthor':43B 'window':27B,36B","search_c":"'allow':67C 'attack':70C 'base':58C 'buffer':59C 'code':73C 'control':66C 'edit':65C 'execut':72C 'heap':57C 'heap-bas':56C 'network':76C 'overflow':60C 'rich':63C 'text':64C 'unauthor':69C 'window':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96081","severity":null,"published_at":"2026-11-10T19:22:06+00:00","modified_at":"2026-11-10T19:22:06+00:00","first_seen_at":"2026-11-10T19:25:30+00:00","fetched_at":"2026-11-10T19:25:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96081:2574","url":null,"severity":null,"published_at":"2026-11-10T19:54:05+00:00","modified_at":"2026-11-10T19:54:05+00:00","first_seen_at":"2026-11-10T19:54:05+00:00","fetched_at":"2026-11-10T19:54:05+00:00","note":"Could not read the primary source. The MSRC update guide is JS-only and web-cli returned empty. The browser tool is out of quota. The MSRC CVRF index only shows the 2026-Nov release (2026-11-10). So the fix is in the November 2026 Windows security updates, but affected builds, KB numbers and whether user interaction is needed are unknown. Nothing verified. Found no reports of exploitation or a public PoC. To settle it, read the MSRC entry for CVE-2026-96081 or the 2026-Nov CVRF document. Sibling CVE-2026-70096 (same component, October, 9.8) is a different record."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}