{"id":"CVE-2026-96115","kind":"vulnerability","aliases":["CVE-2026-96115"],"related":[],"title":"Windows DHCP Client: double free lets a local user gain higher privileges","description":"Double free in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network.","summary":"A double free bug in the Windows DHCP Client lets an authorized attacker on an adjacent network elevate their privileges. An attacker who can reach the machine on the local network and holds some access gets higher rights on that Windows system.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adjacent-network","dhcp-client","infrastructure","local-privilege-escalation","windows"],"not_affected_if":[],"how_to_check":"Unknown: the MSRC entry (msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96115) could not be read (JavaScript-only page). Check it for the KB per Windows build, then compare the installed update (Get-HotFix, or winver build number) against it.","fix":null,"status":"open","published_at":"2026-11-10T19:22:09+00:00","first_seen_at":"2026-11-10T19:25:31+00:00","triaged_at":"2026-11-10T19:36:03+00:00","updated_at":"2026-11-10T19:47:23+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:36:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows DHCP Client: double free lets a local user gain higher privileges","impact":"high","summary":"A double free bug in the Windows DHCP Client lets an authorized attacker on an adjacent network elevate their privileges. An attacker who can reach the machine on the local network and holds some access gets higher rights on that Windows system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","dhcp-client"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker gains elevated privileges on the Windows host","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-96115 for affected builds, fixed updates and any mitigation.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines that use DHCP to get network addresses are the systems to look at, since the DHCP Client service is the flawed component. The sources do not say which Windows builds are affected or whether the flaw needs a specific configuration, so unknown beyond that.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00067,"input_tokens":4488,"output_tokens":442,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-96115 for affected builds, fixed updates and any mitigation.","search":"'-2026':14A,17A '-96115':15A,18A 'access':65B 'adjac':20B,46B,88C 'adjacent-network':19B 'allow':79C 'attack':43B,52B,82C 'author':42B,81C 'bug':34B 'client':3A,24B,39B,78C 'cve':13A,16A 'dhcp':2A,23B,38B,77C 'dhcp-client':22B 'doubl':4A,32B,73C 'elev':48B,84C 'escal':29B 'free':5A,33B,74C 'gain':10A 'get':66B 'higher':11A,67B 'hold':63B 'infrastructur':25B 'let':6A,40B 'local':8A,27B,60B 'local-privilege-escal':26B 'machin':57B 'network':21B,47B,61B,89C 'privileg':12A,28B,50B,85C 'reach':55B 'right':68B 'system':72B 'user':9A 'window':1A,30B,37B,71B,76C","nicknames":[],"mitigations":[],"who_affected":"Windows machines that use DHCP to get network addresses are the systems to look at, since the DHCP Client service is the flawed component. The sources do not say which Windows builds are affected or whether the flaw needs a specific configuration, so unknown beyond that.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adjacentnetwork","dhcpclient","high","infrastructure","localprivilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-96115':15A,18A 'client':3A 'cve':13A,16A 'dhcp':2A 'doubl':4A 'free':5A 'gain':10A 'higher':11A 'let':6A 'local':8A 'privileg':12A 'user':9A 'window':1A","search_b":"'access':65B 'adjac':20B,46B 'adjacent-network':19B 'attack':43B,52B 'author':42B 'bug':34B 'client':24B,39B 'dhcp':23B,38B 'dhcp-client':22B 'doubl':32B 'elev':48B 'escal':29B 'free':33B 'get':66B 'higher':67B 'hold':63B 'infrastructur':25B 'let':40B 'local':27B,60B 'local-privilege-escal':26B 'machin':57B 'network':21B,47B,61B 'privileg':28B,50B 'reach':55B 'right':68B 'system':72B 'window':30B,37B,71B","search_c":"'adjac':88C 'allow':79C 'attack':82C 'author':81C 'client':78C 'dhcp':77C 'doubl':73C 'elev':84C 'free':74C 'network':89C 'privileg':85C 'window':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96115","severity":null,"published_at":"2026-11-10T19:22:09+00:00","modified_at":"2026-11-10T19:22:09+00:00","first_seen_at":"2026-11-10T19:25:31+00:00","fetched_at":"2026-11-10T19:25:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96115:2552","url":null,"severity":null,"published_at":"2026-11-10T19:47:23+00:00","modified_at":"2026-11-10T19:47:23+00:00","first_seen_at":"2026-11-10T19:47:23+00:00","fetched_at":"2026-11-10T19:47:23+00:00","note":"MSRC page returned no text and NVD page is empty, so no affected builds, fix KB or mitigations could be read; nothing verified. CVSS 8.0 AV:A/PR:L from Microsoft per collector. Revisit when MSRC text is reachable. Other DHCP client CVEs (CVE-2026-44815, -69777) are separate."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}