{"id":"CVE-2026-96085","kind":"vulnerability","aliases":["CVE-2026-96085"],"related":[],"title":"Windows Installer: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow (CWE-122) in Windows Installer lets a local user with low privileges gain SYSTEM on the machine. Microsoft rates it Important (CVSS 7.8), says it is not exploited or publicly disclosed, and marks exploitation as less likely. An official fix exists.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows","windows-installer"],"not_affected_if":[],"how_to_check":"Open the MSRC Security Update Guide entry for CVE-2026-96085, find the KB for your Windows version, and compare with installed updates (Settings > Windows Update > Update history). Exact builds: unknown until the KB table is read.","fix":"Install the November 2026 Microsoft security update for your Windows version (the KB number is not yet read from the advisory: unknown).","status":"open","published_at":"2026-11-10T19:22:07+00:00","first_seen_at":"2026-11-10T19:25:30+00:00","triaged_at":"2026-11-10T19:36:32+00:00","updated_at":"2026-11-10T19:48:32+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:36:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Installer: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in Windows Installer lets a logged-in user with authorized access raise their privileges on the machine. The attacker needs local access first and gets elevated rights on that system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-installer"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Find the Microsoft advisory for CVE-2026-96085 to confirm affected Windows builds, the fixed update and any check.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Any Windows machine running the Windows Installer service is in scope, since local users can trigger the flaw. The sources do not say which Windows builds or configurations are patched or affected. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000652,"input_tokens":4488,"output_tokens":407,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-96085 to confirm affected Windows builds, the fixed update and any check.","search":"'-122':34B '-2026':13A,16A '-96085':14A,17A '7.8':55B 'allow':82C 'attack':85C 'author':84C 'base':30B,76C 'buffer':31B,77C 'cve':12A,15A 'cvss':54B 'cwe':33B 'disclos':63B 'elev':87C 'escal':22B 'exist':73B 'exploit':60B,66B 'fix':72B 'gain':9A,45B 'heap':3A,29B,75C 'heap-bas':28B,74C 'higher':10A 'import':53B 'infrastructur':18B 'instal':2A,26B,37B,81C 'less':68B 'let':5A,38B 'like':69B 'local':7A,20B,40B,89C 'local-privilege-escal':19B 'low':43B 'machin':49B 'mark':65B 'microsoft':50B 'offici':71B 'overflow':4A,32B,78C 'privileg':11A,21B,44B,88C 'public':62B 'rate':51B 'say':56B 'system':46B 'user':8A,41B 'window':1A,23B,25B,36B,80C 'windows-instal':24B","nicknames":[],"mitigations":[],"who_affected":"Windows machines where a local user or malware already has a low-privilege account; shared workstations, terminal servers and developer or CI machines matter most. The exact Windows builds are not yet confirmed: check the MSRC page for CVE-2026-96085. Remote-only attackers with no local foothold cannot use it directly.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","windows","windowsinstaller"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96085':14A,17A 'cve':12A,15A 'gain':9A 'heap':3A 'higher':10A 'instal':2A 'let':5A 'local':7A 'overflow':4A 'privileg':11A 'user':8A 'window':1A","search_b":"'-122':34B '7.8':55B 'base':30B 'buffer':31B 'cvss':54B 'cwe':33B 'disclos':63B 'escal':22B 'exist':73B 'exploit':60B,66B 'fix':72B 'gain':45B 'heap':29B 'heap-bas':28B 'import':53B 'infrastructur':18B 'instal':26B,37B 'less':68B 'let':38B 'like':69B 'local':20B,40B 'local-privilege-escal':19B 'low':43B 'machin':49B 'mark':65B 'microsoft':50B 'offici':71B 'overflow':32B 'privileg':21B,44B 'public':62B 'rate':51B 'say':56B 'system':46B 'user':41B 'window':23B,25B,36B 'windows-instal':24B","search_c":"'allow':82C 'attack':85C 'author':84C 'base':76C 'buffer':77C 'elev':87C 'heap':75C 'heap-bas':74C 'instal':81C 'local':89C 'overflow':78C 'privileg':88C 'window':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96085","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96085","severity":null,"published_at":"2026-11-10T19:22:07+00:00","modified_at":"2026-11-10T19:22:07+00:00","first_seen_at":"2026-11-10T19:25:30+00:00","fetched_at":"2026-11-10T19:25:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96085:2556","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96085","severity":null,"published_at":"2026-11-10T19:48:32+00:00","modified_at":"2026-11-10T19:48:32+00:00","first_seen_at":"2026-11-10T19:48:32+00:00","fetched_at":"2026-11-10T19:48:32+00:00","note":"MSRC entry confirmed via API summary (Important EoP, SYSTEM, not exploited, not disclosed, Exploitation Less Likely, official fix exists). The MSRC page is JS-only and the browser session died, so affected builds and KB numbers were NOT retrieved; nothing verified. Revisit with the KB table. X/search not used.","cites":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96085"]}],"documents":[{"id":117693,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96085","title":"MSRC: CVE-2026-96085 Windows Installer Elevation of Privilege","kind":"advisory","source":"analyst","publisher":null,"text":"MSRC entry (read via API summary; product/KB table not retrieved). Severity Important, EoP, CVSS 3.1 7.8, CWE-122. Exploited: No. Publicly disclosed: No. Exploitability: Exploitation Less Likely. FAQ: successful attacker could gain SYSTEM privileges.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}