{"id":"CVE-2026-96139","kind":"vulnerability","aliases":["CVE-2026-96139"],"related":[],"title":"Windows kernel-mode drivers: untrusted pointer lets a local user gain privileges","description":"Untrusted pointer dereference in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.","summary":"A flaw in Windows kernel-mode drivers dereferences an untrusted pointer. An attacker who already has a local account can use it to elevate privileges.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","kernel-drivers","local-privilege-escalation","windows"],"not_affected_if":["patched"],"how_to_check":"Run winver or 'cmd /c ver' on each machine and compare the build number (10.0.<build>.<revision>) to the fixed builds in the fix field. Lower revision means exposed.","fix":"Install the November 2026 Windows cumulative update that raises the build to at least: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822.","status":"open","published_at":"2026-11-10T19:22:11+00:00","first_seen_at":"2026-11-10T19:25:31+00:00","triaged_at":"2026-11-10T19:48:10+00:00","updated_at":"2026-11-10T19:51:36+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:48:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows kernel-mode drivers: untrusted pointer lets a local user gain privileges","impact":"high","summary":"A flaw in Windows kernel-mode drivers dereferences an untrusted pointer. An attacker who already has a local account can use it to elevate privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","kernel-drivers"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains kernel-level privileges on the machine","analyst_note":"Find the affected Windows builds and the Microsoft security update guide entry for CVE-2026-96139 to confirm the fixed versions.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines where a local user with an account can run code; the sources do not name the specific driver or Windows build. Systems where only trusted administrators log in carry less exposure. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000652,"input_tokens":4506,"output_tokens":402,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and the Microsoft security update guide entry for CVE-2026-96139 to confirm the fixed versions.","search":"'-2026':15A,18A '-96139':16A,19A '10':30A '11':21A,24A,27A '2016':43A '2019':40A '2022':37A '2025':34A '22h2':31A '23h2':28A '24h2':22A '25h2':25A 'account':72B 'allow':88C 'alreadi':68B 'attack':66B,91C 'author':90C 'cve':14A,17A 'derefer':61B,81C 'driver':5A,47B,60B,87C 'elev':77B,93C 'escal':51B 'flaw':54B 'gain':12A 'infrastructur':44B 'kernel':3A,46B,58B,85C 'kernel-driv':45B 'kernel-mod':2A,57B,84C 'let':8A 'local':10A,49B,71B,95C 'local-privilege-escal':48B 'mode':4A,59B,86C 'pointer':7A,64B,80C 'privileg':13A,50B,78B,94C 'server':33A,36A,39A,42A 'untrust':6A,63B,79C 'use':74B 'user':11A 'window':1A,52B,56B,83C 'windows':20A,23A,26A,29A,32A,35A,38A,41A","nicknames":[],"mitigations":[],"who_affected":"Windows 10, Windows 11 and Windows Server 2016/2019/2022/2025 machines below the fixed builds where someone can run code with a local low-privilege account (shared servers, RDP/terminal servers, dev and CI machines). The CVSS vector rates attack complexity high and needs local access. Single-user machines with trusted users, or fully patched hosts, can skip it. The specific driver is not named in the sources I could read.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1022h2","1123h2","1124h2","1125h2","server2016","server2019","server2022","server2025","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windowsserver2016","windowsserver2019","windowsserver2022","windowsserver2025"],"ptokens":["10","11","2016","2019","2022","2025","22h2","23h2","24h2","25h2","server","windows"],"labels":["high","infrastructure","kerneldrivers","localprivilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':15A,18A '-96139':16A,19A '10':30A '11':21A,24A,27A '2016':43A '2019':40A '2022':37A '2025':34A '22h2':31A '23h2':28A '24h2':22A '25h2':25A 'cve':14A,17A 'driver':5A 'gain':12A 'kernel':3A 'kernel-mod':2A 'let':8A 'local':10A 'mode':4A 'pointer':7A 'privileg':13A 'server':33A,36A,39A,42A 'untrust':6A 'user':11A 'window':1A 'windows':20A,23A,26A,29A,32A,35A,38A,41A","search_b":"'account':72B 'alreadi':68B 'attack':66B 'derefer':61B 'driver':47B,60B 'elev':77B 'escal':51B 'flaw':54B 'infrastructur':44B 'kernel':46B,58B 'kernel-driv':45B 'kernel-mod':57B 'local':49B,71B 'local-privilege-escal':48B 'mode':59B 'pointer':64B 'privileg':50B,78B 'untrust':63B 'use':74B 'window':52B,56B","search_c":"'allow':88C 'attack':91C 'author':90C 'derefer':81C 'driver':87C 'elev':93C 'kernel':85C 'kernel-mod':84C 'local':95C 'mode':86C 'pointer':80C 'privileg':94C 'untrust':79C 'window':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96139","severity":null,"published_at":"2026-11-10T19:22:11+00:00","modified_at":"2026-11-10T19:22:11+00:00","first_seen_at":"2026-11-10T19:25:31+00:00","fetched_at":"2026-11-10T19:25:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96139:2568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96139","severity":null,"published_at":"2026-11-10T19:51:36+00:00","modified_at":"2026-11-10T19:51:36+00:00","first_seen_at":"2026-11-10T19:51:36+00:00","fetched_at":"2026-11-10T19:51:36+00:00","note":"NVD lists Microsoft CNA affected builds; MSRC update guide is JS-only and unreadable, so nothing marked verified. Fixed builds taken from the NVD listing.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-96139"]}],"documents":[{"id":117705,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96139","title":"NVD CVE-2026-96139 (Microsoft CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}