CVE-2026-96174 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Desktop Window Manager, the Windows component that draws the desktop and windows, has a flaw that releases an invalid pointer or reference. An authorized local attacker can use it to elevate their privileges on the machine.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Windows machines where the November 2026 security update is not installed, if a source confirms their build as affected (builds not yet read). Exposure needs an attacker who already has a local, low-privilege account; single-user or fully trusted systems carry less risk. Shared hosts, remote desktop servers and VDI are the first to check.
Not affected if no-local-untrusted-users
Who cares desktop-window-manager, windows
Check Windows Update history for the November 2026 cumulative update (released 2026-11-10); the exact KB per Windows build is in the MSRC update guide entry for CVE-2026-96174 (not read yet).
Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.