{"id":"CVE-2026-96179","kind":"vulnerability","aliases":["CVE-2026-96179"],"related":[],"title":"Windows DNS Server: use-after-free lets a local user gain privileges","description":"Use after free in DNS Server allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in the Windows DNS Server lets an attacker who already has authorized access on the machine raise their privileges. The NVD entry rates it medium with a CVSS score of 6.7.","severity":"medium","cvss":6.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dns-server","infrastructure","windows"],"not_affected_if":["no-dns-server-role"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:22:18+00:00","first_seen_at":"2026-11-10T19:25:33+00:00","triaged_at":"2026-11-10T19:55:49+00:00","updated_at":"2026-11-10T19:55:49+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:55:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows DNS Server: use-after-free lets a local user gain privileges","impact":"high","summary":"A use-after-free bug in the Windows DNS Server lets an attacker who already has authorized access on the machine raise their privileges. The NVD entry rates it medium with a CVSS score of 6.7.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","dns-server"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the DNS server","analyst_note":"Check the Microsoft Security Update Guide entry for affected Windows builds, patch versions and any mitigation for CVE-2026-96179.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-dns-server-role"],"who_is_affected":"Only servers running the DNS Server role are relevant, and the attacker needs an authorized local account first. The sources do not say which Windows versions are affected or whether the role must be enabled beyond default. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":4473,"output_tokens":428,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-96179':16A,19A '6.7':61B 'access':43B 'allow':68C 'alreadi':40B 'attack':38B,71C 'author':42B,70C 'bug':30B 'cve':14A,17A 'cvss':58B 'dns':2A,21B,34B,66C 'dns-server':20B 'elev':73C 'entri':52B 'free':7A,29B,64C 'gain':12A 'infrastructur':23B 'let':8A,36B 'local':10A,75C 'machin':46B 'medium':55B 'nvd':51B 'privileg':13A,49B,74C 'rais':47B 'rate':53B 'score':59B 'server':3A,22B,35B,67C 'use':5A,27B,62C 'use-after-fre':4A,26B 'user':11A 'window':1A,24B,33B","nicknames":[],"mitigations":[],"who_affected":"Only servers running the DNS Server role are relevant, and the attacker needs an authorized local account first. The sources do not say which Windows versions are affected or whether the role must be enabled beyond default. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dnsserver","infrastructure","medium","windows"],"campaign_type":null,"search_a":"'-2026':15A,18A '-96179':16A,19A 'cve':14A,17A 'dns':2A 'free':7A 'gain':12A 'let':8A 'local':10A 'privileg':13A 'server':3A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A","search_b":"'6.7':61B 'access':43B 'alreadi':40B 'attack':38B 'author':42B 'bug':30B 'cvss':58B 'dns':21B,34B 'dns-server':20B 'entri':52B 'free':29B 'infrastructur':23B 'let':36B 'machin':46B 'medium':55B 'nvd':51B 'privileg':49B 'rais':47B 'rate':53B 'score':59B 'server':22B,35B 'use':27B 'use-after-fre':26B 'window':24B,33B","search_c":"'allow':68C 'attack':71C 'author':70C 'dns':66C 'elev':73C 'free':64C 'local':75C 'privileg':74C 'server':67C 'use':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96179","severity":null,"published_at":"2026-11-10T19:22:18+00:00","modified_at":"2026-11-10T19:22:18+00:00","first_seen_at":"2026-11-10T19:25:33+00:00","fetched_at":"2026-11-10T19:25:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}