---
id: "CVE-2026-96093"
page: "https://infrastack.ai/live/CVE-2026-96093"
kind: "vulnerability"
aliases: ["CVE-2026-96093"]
title: "Windows WinINet: out-of-bounds read lets a local user leak data"
severity: "medium"
cvss: 4.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "windows", "wininet"]
not_affected_if: ["unknown"]
published_at: "2026-11-10T19:22:07+00:00"
first_seen_at: "2026-11-10T19:25:30+00:00"
updated_at: "2026-11-10T20:04:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96093", "first_seen_at": "2026-11-10T19:25:30+00:00"}]
exploit_sources: []
---

# Windows WinINet: out-of-bounds read lets a local user leak data

Link for people: https://infrastack.ai/live/CVE-2026-96093 (this .md is for agents)

A bounds-checking flaw in the Windows Internet library (wininet.dll) lets an authorized local user read memory outside an intended buffer. An attacker can disclose information from the machine but the sources do not say it grants code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T19:25:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96093

## From the sources

Out-of-bounds read in Windows Internet (wininet.dll) allows an authorized attacker to disclose information locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_