{"id":"CVE-2026-96107","kind":"vulnerability","aliases":["CVE-2026-96107"],"related":[],"title":"Windows Phone Service: null pointer flaw lets local users gain privileges","description":"Null pointer dereference in Windows Phone Service allows an authorized attacker to elevate privileges locally.","summary":"A null pointer dereference in the Windows Phone Service lets a user who already has authorized local access raise their privileges. The sources give no detail beyond that description.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 Version 1607","fixed":["10.0.14393.9688"],"affected":">= 10.0.14393.0, < 10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 10 Version 1809","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 Version 21H2","fixed":["10.0.19044.7846"],"affected":">= 10.0.19044.0, < 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 Version 22H2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 Version 23H2","fixed":["10.0.22631.7711"],"affected":">= 10.0.22631.0, < 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 Version 24H2","fixed":["10.0.26100.9974"],"affected":">= 10.0.26100.0, < 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 Version 25H2","fixed":["10.0.26200.9974"],"affected":">= 10.0.26200.0, < 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 Version 26H1","fixed":["10.0.28000.3501"],"affected":">= 10.0.28000.0, < 10.0.28000.3501","ecosystem":"microsoft"},{"name":"Windows 11 Version 26H2","fixed":["10.0.26300.9974"],"affected":">= 10.0.26300.0, < 10.0.26300.9974","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","null-pointer","windows"],"not_affected_if":["patched-build"],"how_to_check":"Run winver or [Environment]::OSVersion in PowerShell and compare the build (10.0.x.y) with the fixed builds listed; below the fixed build means exposed.","fix":"Install the November 2026 Windows cumulative update that moves the build to at least the fixed build for your version (see products); KB numbers unknown, confirm in MSRC Update Guide.","status":"open","published_at":"2026-11-10T19:22:08+00:00","first_seen_at":"2026-11-10T19:25:30+00:00","triaged_at":"2026-11-10T19:48:10+00:00","updated_at":"2026-11-10T19:52:53+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:48:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Phone Service: null pointer flaw lets local users gain privileges","impact":"high","summary":"A null pointer dereference in the Windows Phone Service lets a user who already has authorized local access raise their privileges. The sources give no detail beyond that description.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-96107 for affected Windows builds and the patch.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows systems running the Phone Service are the likely target, since the flaw is in that component. The sources do not say which Windows versions or configurations are affected, so unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000639,"input_tokens":4486,"output_tokens":381,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-96107 for affected Windows builds and the patch.","search":"'-2026':13A,16A '-96107':14A,17A '10':19A,23A,27A,31A '11':35A,39A,43A,47A,51A '1607':21A '1809':25A '21h2':29A '22h2':33A '23h2':37A '24h2':41A '25h2':45A '26h1':49A '26h2':53A 'access':80B 'allow':99C 'alreadi':76B 'attack':102C 'author':78B,101C 'beyond':89B 'cve':12A,15A 'derefer':66B,94C 'descript':91B 'detail':88B 'elev':104C 'escal':58B 'flaw':6A 'gain':10A 'give':86B 'infrastructur':54B 'let':7A,72B 'local':8A,56B,79B,106C 'local-privilege-escal':55B 'null':4A,60B,64B,92C 'null-point':59B 'phone':2A,70B,97C 'pointer':5A,61B,65B,93C 'privileg':11A,57B,83B,105C 'rais':81B 'servic':3A,71B,98C 'sourc':85B 'user':9A,74B 'version':20A,24A,28A,32A,36A,40A,44A,48A,52A 'window':1A,62B,69B,96C 'windows':18A,22A,26A,30A,34A,38A,42A,46A,50A","nicknames":[],"mitigations":[],"who_affected":"Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) machines below the fixed builds. An attacker needs an existing local low-privilege account and the attack is rated high complexity, so shared or multi-user machines, terminal servers and developer workstations matter most; single-user, fully patched machines can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["10version1607","10version1809","10version21h2","10version22h2","11version23h2","11version24h2","11version25h2","11version26h1","11version26h2","windows10version1607","windows10version1809","windows10version21h2","windows10version22h2","windows11version23h2","windows11version24h2","windows11version25h2","windows11version26h1","windows11version26h2"],"ptokens":["10","11","1607","1809","21h2","22h2","23h2","24h2","25h2","26h1","26h2","version","windows"],"labels":["high","infrastructure","localprivilegeescalation","nullpointer","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96107':14A,17A '10':19A,23A,27A,31A '11':35A,39A,43A,47A,51A '1607':21A '1809':25A '21h2':29A '22h2':33A '23h2':37A '24h2':41A '25h2':45A '26h1':49A '26h2':53A 'cve':12A,15A 'flaw':6A 'gain':10A 'let':7A 'local':8A 'null':4A 'phone':2A 'pointer':5A 'privileg':11A 'servic':3A 'user':9A 'version':20A,24A,28A,32A,36A,40A,44A,48A,52A 'window':1A 'windows':18A,22A,26A,30A,34A,38A,42A,46A,50A","search_b":"'access':80B 'alreadi':76B 'author':78B 'beyond':89B 'derefer':66B 'descript':91B 'detail':88B 'escal':58B 'give':86B 'infrastructur':54B 'let':72B 'local':56B,79B 'local-privilege-escal':55B 'null':60B,64B 'null-point':59B 'phone':70B 'pointer':61B,65B 'privileg':57B,83B 'rais':81B 'servic':71B 'sourc':85B 'user':74B 'window':62B,69B","search_c":"'allow':99C 'attack':102C 'author':101C 'derefer':94C 'elev':104C 'local':106C 'null':92C 'phone':97C 'pointer':93C 'privileg':105C 'servic':98C 'window':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96107","severity":null,"published_at":"2026-11-10T19:22:08+00:00","modified_at":"2026-11-10T19:22:08+00:00","first_seen_at":"2026-11-10T19:25:30+00:00","fetched_at":"2026-11-10T19:25:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96107:2570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96107","severity":null,"published_at":"2026-11-10T19:52:53+00:00","modified_at":"2026-11-10T19:52:53+00:00","first_seen_at":"2026-11-10T19:52:53+00:00","fetched_at":"2026-11-10T19:52:53+00:00","note":"NVD (Microsoft CNA data) lists affected Windows builds and fixed build numbers; MSRC page is JS-only and returned nothing, so nothing marked verified. No exploitation or PoC found in sources.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-96107"]}],"documents":[{"id":117707,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96107","title":"NVD CVE-2026-96107 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}