{"id":"CVE-2026-96172","kind":"vulnerability","aliases":["CVE-2026-96172"],"related":[],"title":"Windows Desktop Window Manager: local user can gain elevated privileges","description":"No cwe for this issue in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","summary":"Microsoft rates this Desktop Window Manager flaw Important (CVSS 7.8). A local attacker with a low-privileged account who exploits it could gain SYSTEM privileges. The weakness is CWE-763 (release of invalid pointer or reference). Microsoft says it is not publicly disclosed or exploited and rates exploitation less likely. It was published in the November 2026 release.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-window-manager","infrastructure","local","privilege-escalation","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"Look up CVE-2026-96172 in the Microsoft Security Update Guide for your Windows version, then compare your installed cumulative update (winver or Get-HotFix) with the November 2026 update listed there. The affected builds and KB numbers were not in the data I could read, so they are unknown.","fix":"Install the November 2026 Windows security update (Microsoft marks customer action as required). The exact KB and build numbers are unknown; the Update Guide page for this CVE lists them.","status":"open","published_at":"2026-11-10T19:22:17+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","triaged_at":"2026-11-10T19:36:22+00:00","updated_at":"2026-11-10T19:42:14+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:36:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Desktop Window Manager: local user can gain elevated privileges","impact":"high","summary":"A flaw in Windows Desktop Window Manager lets an attacker who already has a local account raise their privileges. The sources give no further detail on the exact mechanism.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local attacker gains higher system privileges on the Windows machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-96172 for affected Windows builds, the fixed update, and whether a fix is available; the NVD record lacks CWE and product ranges.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running Microsoft Windows where local users are not fully trusted. The sources do not say which Windows builds are affected or whether a specific configuration is needed. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":4488,"output_tokens":417,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-96172 for affected Windows builds, the fixed update, and whether a fix is available; the NVD record lacks CWE and product ranges.","search":"'-2026':12A,15A '-763':57B '-96172':13A,16A '2026':84B '7.8':36B 'account':45B 'allow':95C 'attack':39B,98C 'author':97C 'could':49B 'cve':11A,14A 'cvss':35B 'cwe':56B,87C 'desktop':2A,18B,30B,92C 'desktop-window-manag':17B 'disclos':70B 'elev':9A,100C 'escal':25B 'exploit':47B,72B,75B 'flaw':33B 'gain':8A,50B 'import':34B 'infrastructur':21B 'invalid':60B 'issu':90C 'less':76B 'like':77B 'local':5A,22B,38B,102C 'low':43B 'low-privileg':42B 'manag':4A,20B,32B,94C 'microsoft':27B,64B 'novemb':83B 'pointer':61B 'privileg':10A,24B,44B,52B,101C 'privilege-escal':23B 'public':69B 'publish':80B 'rate':28B,74B 'refer':63B 'releas':58B,85B 'say':65B 'system':51B 'user':6A 'weak':54B 'window':1A,3A,19B,26B,31B,93C","nicknames":[],"mitigations":[],"who_affected":"Windows systems where users or software without full trust can run code locally, such as shared workstations, RDP/terminal servers, VDI and developer machines. An attacker needs an existing low-privileged local account. The affected Windows versions are unknown from the sources I read. Single-user machines with no untrusted code are lower risk, but should still patch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["desktopwindowmanager","high","infrastructure","local","privilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':12A,15A '-96172':13A,16A 'cve':11A,14A 'desktop':2A 'elev':9A 'gain':8A 'local':5A 'manag':4A 'privileg':10A 'user':6A 'window':1A,3A","search_b":"'-763':57B '2026':84B '7.8':36B 'account':45B 'attack':39B 'could':49B 'cvss':35B 'cwe':56B 'desktop':18B,30B 'desktop-window-manag':17B 'disclos':70B 'escal':25B 'exploit':47B,72B,75B 'flaw':33B 'gain':50B 'import':34B 'infrastructur':21B 'invalid':60B 'less':76B 'like':77B 'local':22B,38B 'low':43B 'low-privileg':42B 'manag':20B,32B 'microsoft':27B,64B 'novemb':83B 'pointer':61B 'privileg':24B,44B,52B 'privilege-escal':23B 'public':69B 'publish':80B 'rate':28B,74B 'refer':63B 'releas':58B,85B 'say':65B 'system':51B 'weak':54B 'window':19B,26B,31B","search_c":"'allow':95C 'attack':98C 'author':97C 'cwe':87C 'desktop':92C 'elev':100C 'issu':90C 'local':102C 'manag':94C 'privileg':101C 'window':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96172","severity":null,"published_at":"2026-11-10T19:22:17+00:00","modified_at":"2026-11-10T19:22:17+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","fetched_at":"2026-11-10T19:25:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96172:2537","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-96172","severity":null,"published_at":"2026-11-10T19:42:14+00:00","modified_at":"2026-11-10T19:42:14+00:00","first_seen_at":"2026-11-10T19:42:14+00:00","fetched_at":"2026-11-10T19:42:14+00:00","note":"MSRC Update Guide API (Nov 2026 release): Important EoP, CWE-763, SYSTEM, not exploited, not publicly disclosed, Exploitation Less Likely; no build/KB list in the data I could read.","cites":["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-96172"]}],"documents":[{"id":117659,"url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-96172","title":"MSRC: CVE-2026-96172 Desktop Window Manager Elevation of Privilege Vulnerability","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}