{"id":"CVE-2026-96156","kind":"vulnerability","aliases":["CVE-2026-96156"],"related":[],"title":"Windows Broker Infrastructure Service: uninitialized memory leaks data to local users","description":"Use of uninitialized resource in Windows Broker Infrastructure Service allows an authorized attacker to disclose information locally.","summary":"Windows Broker Infrastructure Service reads a resource before setting it, so memory contents can leak. An authorized local user can read information they should not see.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows"],"not_affected_if":["no-local-accounts"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:22:12+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","triaged_at":"2026-11-10T20:00:17+00:00","updated_at":"2026-11-10T20:00:17+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:00:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Broker Infrastructure Service: uninitialized memory leaks data to local users","impact":"low","summary":"Windows Broker Infrastructure Service reads a resource before setting it, so memory contents can leak. An authorized local user can read information they should not see.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user reads some leaked memory contents","analyst_note":"Confirm affected Windows builds and the Microsoft patch from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-96156 and the Microsoft Security Update Guide.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-accounts"],"who_is_affected":"Only users with a local account on the Windows machine can trigger it, since it requires an authorized attacker and local access. The sources do not say which Windows builds are affected or how to confirm exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":4497,"output_tokens":423,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-96156':14A,17A 'allow':55C 'attack':58C 'author':36B,57C 'broker':2A,21B,52C 'content':32B 'cve':12A,15A 'data':8A 'disclos':60C 'inform':41B,61C 'infrastructur':3A,18B,22B,53C 'leak':7A,34B 'local':10A,37B,62C 'memori':6A,31B 'read':24B,40B 'resourc':26B,49C 'see':45B 'servic':4A,23B,54C 'set':28B 'uniniti':5A,48C 'use':46C 'user':11A,38B 'window':1A,19B,20B,51C","nicknames":[],"mitigations":[],"who_affected":"Only users with a local account on the Windows machine can trigger it, since it requires an authorized attacker and local access. The sources do not say which Windows builds are affected or how to confirm exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","medium","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96156':14A,17A 'broker':2A 'cve':12A,15A 'data':8A 'infrastructur':3A 'leak':7A 'local':10A 'memori':6A 'servic':4A 'uniniti':5A 'user':11A 'window':1A","search_b":"'author':36B 'broker':21B 'content':32B 'inform':41B 'infrastructur':18B,22B 'leak':34B 'local':37B 'memori':31B 'read':24B,40B 'resourc':26B 'see':45B 'servic':23B 'set':28B 'user':38B 'window':19B,20B","search_c":"'allow':55C 'attack':58C 'author':57C 'broker':52C 'disclos':60C 'inform':61C 'infrastructur':53C 'local':62C 'resourc':49C 'servic':54C 'uniniti':48C 'use':46C 'window':51C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96156","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96156","severity":null,"published_at":"2026-11-10T19:22:12+00:00","modified_at":"2026-11-10T19:22:12+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","fetched_at":"2026-11-10T19:25:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}