{"id":"CVE-2026-96162","kind":"vulnerability","aliases":["CVE-2026-96162"],"related":[],"title":"Windows: clipboard virtual channel flaw lets a local user gain privileges","description":"Incorrect authorization in Windows Clipboard Virtual Channel Extension allows an authorized attacker to elevate privileges locally.","summary":"The Windows Clipboard Virtual Channel Extension has an incorrect authorization check that lets an already-authorized user raise their privileges on the machine. An attacker needs a local foothold on the system to use it.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","rdp","remote-desktop","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:22:13+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","triaged_at":"2026-11-10T19:36:22+00:00","updated_at":"2026-11-10T19:42:18+00:00","category":"infrastructure","confidence":0.2,"triage":{"at":"2026-11-10T19:36:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: clipboard virtual channel flaw lets a local user gain privileges","impact":"high","summary":"The Windows Clipboard Virtual Channel Extension has an incorrect authorization check that lets an already-authorized user raise their privileges on the machine. An attacker needs a local foothold on the system to use it.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","remote-desktop"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user becomes administrator or SYSTEM on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-96162 for affected Windows builds, the fixed update, and any required configuration.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines that use the Clipboard Virtual Channel Extension, typically remote desktop or virtualized sessions, are the place to look. The sources do not say which Windows builds are affected or which configurations expose the component, so unknown. Systems that do not use remote sessions with clipboard redirection are likely not exposed, but the sources do not confirm this.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000691,"input_tokens":4502,"output_tokens":481,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-96162 for affected Windows builds, the fixed update, and any required configuration.","search":"'-2026':13A,16A '-96162':14A,17A 'allow':71C 'alreadi':43B 'already-author':42B 'attack':53B,74C 'author':37B,44B,64C,73C 'channel':4A,32B,69C 'check':38B 'clipboard':2A,30B,67C 'cve':12A,15A 'desktop':26B 'elev':76C 'escal':22B 'extens':33B,70C 'flaw':5A 'foothold':57B 'gain':10A 'incorrect':36B,63C 'infrastructur':18B 'let':6A,40B 'local':8A,20B,56B,78C 'local-privilege-escal':19B 'machin':51B 'need':54B 'privileg':11A,21B,48B,77C 'rais':46B 'rdp':23B 'remot':25B 'remote-desktop':24B 'system':60B 'use':62B 'user':9A,45B 'virtual':3A,31B,68C 'window':1A,27B,29B,66C","nicknames":[],"mitigations":[],"who_affected":"Windows machines that use the Clipboard Virtual Channel Extension, typically remote desktop or virtualized sessions, are the place to look. The sources do not say which Windows builds are affected or which configurations expose the component, so unknown. Systems that do not use remote sessions with clipboard redirection are likely not exposed, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","rdp","remotedesktop","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96162':14A,17A 'channel':4A 'clipboard':2A 'cve':12A,15A 'flaw':5A 'gain':10A 'let':6A 'local':8A 'privileg':11A 'user':9A 'virtual':3A 'window':1A","search_b":"'alreadi':43B 'already-author':42B 'attack':53B 'author':37B,44B 'channel':32B 'check':38B 'clipboard':30B 'desktop':26B 'escal':22B 'extens':33B 'foothold':57B 'incorrect':36B 'infrastructur':18B 'let':40B 'local':20B,56B 'local-privilege-escal':19B 'machin':51B 'need':54B 'privileg':21B,48B 'rais':46B 'rdp':23B 'remot':25B 'remote-desktop':24B 'system':60B 'use':62B 'user':45B 'virtual':31B 'window':27B,29B","search_c":"'allow':71C 'attack':74C 'author':64C,73C 'channel':69C 'clipboard':67C 'elev':76C 'extens':70C 'incorrect':63C 'local':78C 'privileg':77C 'virtual':68C 'window':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96162","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96162","severity":null,"published_at":"2026-11-10T19:22:13+00:00","modified_at":"2026-11-10T19:22:13+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","fetched_at":"2026-11-10T19:25:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96162:2539","url":null,"severity":null,"published_at":"2026-11-10T19:42:18+00:00","modified_at":"2026-11-10T19:42:18+00:00","first_seen_at":"2026-11-10T19:42:18+00:00","fetched_at":"2026-11-10T19:42:18+00:00","note":"Could not read the MSRC Update Guide page, the NVD page or any mirror for this CVE (they return empty or JS-only). Search found no source naming affected builds or KBs. Nothing verified; fix and affected versions are unknown. Settling it needs the MSRC entry for CVE-2026-96162 or the November 2026 Patch Tuesday KB list. Triage summary (local authorized user, incorrect authorization, RDP clipboard channel) is unconfirmed. Not to be confused with CVE-2026-85912 (Clipboard User Service, Oct 2026), which is a different bug."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}