{"id":"CVE-2026-96102","kind":"vulnerability","aliases":["CVE-2026-96102"],"related":[],"title":"Windows TCP/IP: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","summary":"Heap-based buffer overflow in the Windows TCP/IP stack lets an authorized local attacker raise privileges (CVSS 7.8 High per CVE listing). Affected Windows builds, fixed KBs and exploitation status could not be read from Microsoft's page yet.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows TCP/IP","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local-privilege-escalation","tcp-ip","windows"],"not_affected_if":[],"how_to_check":"unknown: Microsoft's update guide entry for CVE-2026-96102 lists the affected builds and KBs. Until read, treat any Windows machine missing the latest cumulative update as possibly exposed; check with winver or Get-HotFix.","fix":null,"status":"open","published_at":"2026-11-10T19:22:08+00:00","first_seen_at":"2026-11-10T19:25:30+00:00","triaged_at":"2026-11-10T19:36:32+00:00","updated_at":"2026-11-10T19:48:22+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:36:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows TCP/IP: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows TCP/IP networking stack lets an authorized local user elevate privileges. The sources do not give more detail on the trigger or the affected Windows builds.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","tcp-ip"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the Windows machine","analyst_note":"Check the Microsoft security update guide for CVE-2026-96102 for affected Windows builds, fixed versions and any mitigation; the NVD entry alone gives none.","how_to_check":"- unknown","plain_action":"","product_name":"Windows TCP/IP","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Affected systems are Windows machines where a user already has a local account, since the flaw needs an authorized attacker. The sources do not list affected Windows versions or the specific component state needed. unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4494,"output_tokens":458,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft security update guide for CVE-2026-96102 for affected Windows builds, fixed versions and any mitigation; the NVD entry alone gives none.","search":"'-2026':13A,16A '-96102':14A,17A '7.8':47B 'affect':52B 'allow':77C 'attack':43B,80C 'author':41B,79C 'base':31B,71C 'buffer':32B,72C 'build':54B 'could':60B 'cve':12A,15A,50B 'cvss':46B 'elev':82C 'escal':24B 'exploit':58B 'fix':55B 'gain':9A 'heap':3A,30B,70C 'heap-bas':29B,69C 'high':48B 'higher':10A 'infrastructur':20B 'ip':27B 'kbs':56B 'let':5A,39B 'list':51B 'local':7A,22B,42B,84C 'local-privilege-escal':21B 'microsoft':65B 'overflow':4A,33B,73C 'page':67B 'per':49B 'privileg':11A,23B,45B,83C 'rais':44B 'read':63B 'stack':38B 'status':59B 'tcp':26B 'tcp-ip':25B 'tcp/ip':2A,19A,37B,76C 'user':8A 'window':1A,28B,36B,53B,75C 'windows':18A 'yet':68B","nicknames":[],"mitigations":[],"who_affected":"Affected systems are Windows machines where a user already has a local account, since the flaw needs an authorized attacker. The sources do not list affected Windows versions or the specific component state needed. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["tcpip","windowstcpip"],"ptokens":["ip","tcp","windows"],"labels":["high","infrastructure","localprivilegeescalation","tcpip","vendor","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96102':14A,17A 'cve':12A,15A 'gain':9A 'heap':3A 'higher':10A 'let':5A 'local':7A 'overflow':4A 'privileg':11A 'tcp/ip':2A,19A 'user':8A 'window':1A 'windows':18A","search_b":"'7.8':47B 'affect':52B 'attack':43B 'author':41B 'base':31B 'buffer':32B 'build':54B 'could':60B 'cve':50B 'cvss':46B 'escal':24B 'exploit':58B 'fix':55B 'heap':30B 'heap-bas':29B 'high':48B 'infrastructur':20B 'ip':27B 'kbs':56B 'let':39B 'list':51B 'local':22B,42B 'local-privilege-escal':21B 'microsoft':65B 'overflow':33B 'page':67B 'per':49B 'privileg':23B,45B 'rais':44B 'read':63B 'stack':38B 'status':59B 'tcp':26B 'tcp-ip':25B 'tcp/ip':37B 'window':28B,36B,53B 'yet':68B","search_c":"'allow':77C 'attack':80C 'author':79C 'base':71C 'buffer':72C 'elev':82C 'heap':70C 'heap-bas':69C 'local':84C 'overflow':73C 'privileg':83C 'tcp/ip':76C 'window':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96102","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96102","severity":null,"published_at":"2026-11-10T19:22:08+00:00","modified_at":"2026-11-10T19:22:08+00:00","first_seen_at":"2026-11-10T19:25:30+00:00","fetched_at":"2026-11-10T19:25:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96102:2554","url":null,"severity":null,"published_at":"2026-11-10T19:48:22+00:00","modified_at":"2026-11-10T19:48:22+00:00","first_seen_at":"2026-11-10T19:48:22+00:00","fetched_at":"2026-11-10T19:48:22+00:00","note":"MSRC update-guide page is JS-only and returned empty via web-cli/WebFetch; NVD page empty too. Only a CVE listing (casco.com) confirms: heap-based buffer overflow in Windows TCP/IP, local EoP, CVSS 7.8 High, updated 2026-11-10. No affected builds, KBs, exploitation status or mitigations found; sibling Oct 2026 TCP/IP CVEs (96852, 83842) have different build lists and were not applied. Nothing verified. Settle by reading the MSRC page in a browser or its CSAF/API entry."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}