{"id":"CVE-2026-96117","kind":"vulnerability","aliases":["CVE-2026-96117"],"related":[],"title":"Windows LUAFV: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows LUAFV driver, which handles file virtualization for legacy applications, lets an authorized local user elevate privileges. An attacker who already has a logon on the machine can gain system-level control.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","luafv","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:22:09+00:00","first_seen_at":"2026-11-10T19:25:31+00:00","triaged_at":"2026-11-10T19:36:28+00:00","updated_at":"2026-11-10T19:47:22+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-10T19:36:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows LUAFV: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows LUAFV driver, which handles file virtualization for legacy applications, lets an authorized local user elevate privileges. An attacker who already has a logon on the machine can gain system-level control.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local user gains SYSTEM-level privileges on the Windows machine","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds and the patch KB.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Any Windows machine with the affected LUAFV component is exposed to a local user who already has an account on it. Exposure depends on the Windows build and patch level, which the sources do not state. Machines where every user is fully trusted and no untrusted local account exists are lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":4492,"output_tokens":451,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds and the patch KB.","search":"'-2026':13A,16A '-96117':14A,17A 'allow':74C 'alreadi':53B 'applic':42B 'attack':51B,77C 'author':45B,76C 'base':28B,68C 'buffer':29B,69C 'control':65B 'cve':12A,15A 'driver':35B 'elev':48B,79C 'escal':22B 'file':38B 'gain':9A,61B 'handl':37B 'heap':3A,27B,67C 'heap-bas':26B,66C 'higher':10A 'infrastructur':18B 'legaci':41B 'let':5A,43B 'level':64B 'local':7A,20B,46B,81C 'local-privilege-escal':19B 'logon':56B 'luafv':2A,23B,34B,73C 'machin':59B 'overflow':4A,30B,70C 'privileg':11A,21B,49B,80C 'system':63B 'system-level':62B 'user':8A,47B 'virtual':39B 'window':1A,24B,33B,72C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine with the affected LUAFV component is exposed to a local user who already has an account on it. Exposure depends on the Windows build and patch level, which the sources do not state. Machines where every user is fully trusted and no untrusted local account exists are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","luafv","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96117':14A,17A 'cve':12A,15A 'gain':9A 'heap':3A 'higher':10A 'let':5A 'local':7A 'luafv':2A 'overflow':4A 'privileg':11A 'user':8A 'window':1A","search_b":"'alreadi':53B 'applic':42B 'attack':51B 'author':45B 'base':28B 'buffer':29B 'control':65B 'driver':35B 'elev':48B 'escal':22B 'file':38B 'gain':61B 'handl':37B 'heap':27B 'heap-bas':26B 'infrastructur':18B 'legaci':41B 'let':43B 'level':64B 'local':20B,46B 'local-privilege-escal':19B 'logon':56B 'luafv':23B,34B 'machin':59B 'overflow':30B 'privileg':21B,49B 'system':63B 'system-level':62B 'user':47B 'virtual':39B 'window':24B,33B","search_c":"'allow':74C 'attack':77C 'author':76C 'base':68C 'buffer':69C 'elev':79C 'heap':67C 'heap-bas':66C 'local':81C 'luafv':73C 'overflow':70C 'privileg':80C 'window':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96117","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96117","severity":null,"published_at":"2026-11-10T19:22:09+00:00","modified_at":"2026-11-10T19:22:09+00:00","first_seen_at":"2026-11-10T19:25:31+00:00","fetched_at":"2026-11-10T19:25:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96117:2551","url":null,"severity":null,"published_at":"2026-11-10T19:47:22+00:00","modified_at":"2026-11-10T19:47:22+00:00","first_seen_at":"2026-11-10T19:47:22+00:00","fetched_at":"2026-11-10T19:47:22+00:00","note":"NVD and cve.org pages for CVE-2026-96117 return no description, versions or KB, and MSRC has no indexed page. Searches found no source for this ID. A sibling, CVE-2026-50472 (published 2026-08-11), has the same LUAFV heap overflow wording, CVSS 7.0 AV:L/AC:H/PR:L, and is not in KEV. I did not copy its versions here because the ID is not confirmed to be the same record. Possibly a mistyped or reserved ID, or a duplicate of 50472; code decides merges. Settled by the MSRC update-guide entry for this exact ID. Nothing verified."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}