{"id":"CVE-2026-96174","kind":"vulnerability","aliases":["CVE-2026-96174"],"related":[],"title":"Windows Desktop Window Manager: local flaw lets a logged-in user gain higher privileges","description":"Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","summary":"Desktop Window Manager, the Windows component that draws the desktop and windows, has a flaw that releases an invalid pointer or reference. An authorized local attacker can use it to elevate their privileges on the machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-window-manager","infrastructure","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"Check Windows Update history for the November 2026 cumulative update (released 2026-11-10); the exact KB per Windows build is in the MSRC update guide entry for CVE-2026-96174 (not read yet).","fix":"Install the November 2026 Windows security update (Patch Tuesday, 2026-11-10) for your Windows build. Exact KB and build numbers: unknown, see MSRC update guide.","status":"open","published_at":"2026-11-10T19:22:17+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","triaged_at":"2026-11-10T19:36:21+00:00","updated_at":"2026-11-10T19:39:44+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:36:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Desktop Window Manager: local flaw lets a logged-in user gain higher privileges","impact":"high","summary":"Desktop Window Manager, the Windows component that draws the desktop and windows, has a flaw that releases an invalid pointer or reference. An authorized local attacker can use it to elevate their privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","desktop-window-manager"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains administrator or SYSTEM privileges on the machine","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-96174 to get affected Windows builds and the patch.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Any Windows machine running the affected Desktop Window Manager build is exposed to a local user who already has an account. The sources do not name the affected Windows versions or the patch. Systems where every user is trusted and no untrusted local accounts exist carry less risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":4492,"output_tokens":460,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-96174 to get affected Windows builds and the patch.","search":"'-2026':17A,20A '-96174':18A,21A 'allow':74C 'attack':53B,77C 'author':51B,76C 'compon':33B 'cve':16A,19A 'desktop':2A,23B,28B,37B,71C 'desktop-window-manag':22B 'draw':35B 'elev':58B,79C 'flaw':6A,42B 'gain':13A 'higher':14A 'infrastructur':26B 'invalid':46B,66C 'let':7A 'local':5A,52B,81C 'log':10A 'logged-in':9A 'machin':63B 'manag':4A,25B,30B,73C 'pointer':47B,67C 'privileg':15A,60B,80C 'refer':49B,69C 'releas':44B,64C 'use':55B 'user':12A 'window':1A,3A,24B,27B,29B,32B,39B,72C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where the November 2026 security update is not installed, if a source confirms their build as affected (builds not yet read). Exposure needs an attacker who already has a local, low-privilege account; single-user or fully trusted systems carry less risk. Shared hosts, remote desktop servers and VDI are the first to check.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["desktopwindowmanager","high","infrastructure","windows"],"campaign_type":null,"search_a":"'-2026':17A,20A '-96174':18A,21A 'cve':16A,19A 'desktop':2A 'flaw':6A 'gain':13A 'higher':14A 'let':7A 'local':5A 'log':10A 'logged-in':9A 'manag':4A 'privileg':15A 'user':12A 'window':1A,3A","search_b":"'attack':53B 'author':51B 'compon':33B 'desktop':23B,28B,37B 'desktop-window-manag':22B 'draw':35B 'elev':58B 'flaw':42B 'infrastructur':26B 'invalid':46B 'local':52B 'machin':63B 'manag':25B,30B 'pointer':47B 'privileg':60B 'refer':49B 'releas':44B 'use':55B 'window':24B,27B,29B,32B,39B","search_c":"'allow':74C 'attack':77C 'author':76C 'desktop':71C 'elev':79C 'invalid':66C 'local':81C 'manag':73C 'pointer':67C 'privileg':80C 'refer':69C 'releas':64C 'window':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96174","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96174","severity":null,"published_at":"2026-11-10T19:22:17+00:00","modified_at":"2026-11-10T19:22:17+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","fetched_at":"2026-11-10T19:25:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96174:2536","url":null,"severity":null,"published_at":"2026-11-10T19:39:44+00:00","modified_at":"2026-11-10T19:39:44+00:00","first_seen_at":"2026-11-10T19:39:44+00:00","fetched_at":"2026-11-10T19:39:44+00:00","note":"MSRC update guide page is JS-only (empty text); MSRC API only confirms it is in the November 2026 Security Updates (released 2026-11-10). Affected builds and KBs not read; full CVRF (api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Nov) is too large to read here. No exploitation or PoC found. Nothing verified."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}