{"id":"CVE-2026-96175","kind":"vulnerability","aliases":["CVE-2026-96175"],"related":[],"title":"Windows Desktop Window Manager: invalid pointer release lets local users gain privileges","description":"Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","summary":"Desktop Window Manager, the Windows component that draws the screen, releases an invalid pointer or reference. A signed-in user with low privileges can use this to gain higher privileges on the same machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Desktop Window Manager","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["desktop-window-manager","infrastructure","windows"],"not_affected_if":[],"how_to_check":"Unknown. Microsoft's Update Guide entry for CVE-2026-96175 lists the affected Windows builds and KBs, but I could not read it. Compare the installed November 2026 cumulative update (Settings > Windows Update > Update history) against that entry.","fix":null,"status":"open","published_at":"2026-11-10T19:22:17+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","triaged_at":"2026-11-10T19:36:20+00:00","updated_at":"2026-11-10T19:40:22+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-10T19:36:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Desktop Window Manager: invalid pointer release lets local users gain privileges","impact":"high","summary":"Desktop Window Manager, the Windows component that draws the screen, releases an invalid pointer or reference. A signed-in user with low privileges can use this to gain higher privileges on the same machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","desktop-window-manager"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the machine","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-96175 to get affected Windows builds and the patch.","how_to_check":"unknown","plain_action":"","product_name":"Desktop Window Manager","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines where users with local accounts can run code. The sources do not name affected Windows builds, so unknown which versions are affected. Systems with no untrusted local users are lower risk.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000667,"input_tokens":4492,"output_tokens":436,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-96175 to get affected Windows builds and the patch.","search":"'-2026':14A,17A '-96175':15A,18A 'allow':73C 'attack':76C 'author':75C 'compon':33B 'cve':13A,16A 'desktop':2A,19A,23B,28B,70C 'desktop-window-manag':22B 'draw':35B 'elev':78C 'gain':11A,56B 'higher':57B 'infrastructur':26B 'invalid':5A,40B,65C 'let':8A 'local':9A,80C 'low':50B 'machin':62B 'manag':4A,25B,30B,72C 'manager':21A 'pointer':6A,41B,66C 'privileg':12A,51B,58B,79C 'refer':43B,68C 'releas':7A,38B,63C 'screen':37B 'sign':46B 'signed-in':45B 'use':53B 'user':10A,48B 'window':1A,3A,20A,24B,27B,29B,32B,71C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where users with local accounts can run code. The sources do not name affected Windows builds, so unknown which versions are affected. Systems with no untrusted local users are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["desktopwindowmanager","windowmanager"],"ptokens":["desktop","manager","window"],"labels":["desktopwindowmanager","high","infrastructure","vendor","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-96175':15A,18A 'cve':13A,16A 'desktop':2A,19A 'gain':11A 'invalid':5A 'let':8A 'local':9A 'manag':4A 'manager':21A 'pointer':6A 'privileg':12A 'releas':7A 'user':10A 'window':1A,3A,20A","search_b":"'compon':33B 'desktop':23B,28B 'desktop-window-manag':22B 'draw':35B 'gain':56B 'higher':57B 'infrastructur':26B 'invalid':40B 'low':50B 'machin':62B 'manag':25B,30B 'pointer':41B 'privileg':51B,58B 'refer':43B 'releas':38B 'screen':37B 'sign':46B 'signed-in':45B 'use':53B 'user':48B 'window':24B,27B,29B,32B","search_c":"'allow':73C 'attack':76C 'author':75C 'desktop':70C 'elev':78C 'invalid':65C 'local':80C 'manag':72C 'pointer':66C 'privileg':79C 'refer':68C 'releas':63C 'window':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96175","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96175","severity":null,"published_at":"2026-11-10T19:22:17+00:00","modified_at":"2026-11-10T19:22:17+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","fetched_at":"2026-11-10T19:25:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96175:2535","url":null,"severity":null,"published_at":"2026-11-10T19:40:22+00:00","modified_at":"2026-11-10T19:40:22+00:00","first_seen_at":"2026-11-10T19:40:22+00:00","fetched_at":"2026-11-10T19:40:22+00:00","note":"Could not read the MSRC entry: the page is JS-only (browser session died), web-cli returned nothing, and the November 2026 CVRF is over 10 MB. No affected builds, KBs or fix confirmed. Nothing verified. Only part of the exposure is known from NVD/triage: local low-privilege EoP in DWM. To settle it, read the CVE-2026-96175 entry in the MSRC Update Guide or CSAF."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}