{"id":"CVE-2026-96184","kind":"vulnerability","aliases":["CVE-2026-96184"],"related":[],"title":"Windows MDM: heap overflow lets an authorized user gain local privileges","description":"Heap-based buffer overflow in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in Windows Modern Device Management (MDM) lets an attacker who already has authorized access raise their privileges on the local machine. The sources do not describe a remote trigger or a public exploit.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoint-management","infrastructure","local-privilege-escalation","mdm","windows"],"not_affected_if":["no-mdm-enrollment","unmanaged-devices"],"how_to_check":"Unknown until the MSRC advisory is read. Likely check: compare the installed Windows build (winver or Get-ComputerInfo) with the build listed for CVE-2026-96184 in the Microsoft Security Update Guide.","fix":null,"status":"open","published_at":"2026-11-10T19:22:18+00:00","first_seen_at":"2026-11-10T19:25:33+00:00","triaged_at":"2026-11-10T19:36:18+00:00","updated_at":"2026-11-10T19:40:06+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-10T19:36:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows MDM: heap overflow lets an authorized user gain local privileges","impact":"high","summary":"A heap-based buffer overflow in Windows Modern Device Management (MDM) lets an attacker who already has authorized access raise their privileges on the local machine. The sources do not describe a remote trigger or a public exploit.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","mdm","endpoint-management"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains elevated system privileges on the machine","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-96184 to confirm affected Windows builds, the fixed update, and whether MDM must be enabled.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unmanaged-devices","no-mdm-enrollment"],"who_is_affected":"Affected systems are Windows machines that use Modern Device Management, typically enrolled in an MDM service. The sources do not list affected Windows builds. Only accounts already authorized on the device can use this flaw, so exposure depends on who holds local or enrolled access.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000694,"input_tokens":4502,"output_tokens":487,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-96184 to confirm affected Windows builds, the fixed update, and whether MDM must be enabled.","search":"'-2026':13A,16A '-96184':14A,17A 'access':47B 'allow':78C 'alreadi':44B 'attack':42B,81C 'author':7A,46B,80C 'base':31B,69C 'buffer':32B,70C 'cve':12A,15A 'describ':59B 'devic':37B,75C 'elev':83C 'endpoint':19B 'endpoint-manag':18B 'escal':25B 'exploit':66B 'gain':9A 'heap':3A,30B,68C 'heap-bas':29B,67C 'infrastructur':21B 'let':5A,40B 'local':10A,23B,53B,85C 'local-privilege-escal':22B 'machin':54B 'manag':20B,38B,76C 'mdm':2A,26B,39B,77C 'modern':36B,74C 'overflow':4A,33B,71C 'privileg':11A,24B,50B,84C 'public':65B 'rais':48B 'remot':61B 'sourc':56B 'trigger':62B 'user':8A 'window':1A,27B,35B,73C","nicknames":[],"mitigations":[],"who_affected":"Affected systems are Windows machines that use Modern Device Management, typically enrolled in an MDM service. The sources do not list affected Windows builds. Only accounts already authorized on the device can use this flaw, so exposure depends on who holds local or enrolled access.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["endpointmanagement","high","infrastructure","localprivilegeescalation","mdm","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96184':14A,17A 'author':7A 'cve':12A,15A 'gain':9A 'heap':3A 'let':5A 'local':10A 'mdm':2A 'overflow':4A 'privileg':11A 'user':8A 'window':1A","search_b":"'access':47B 'alreadi':44B 'attack':42B 'author':46B 'base':31B 'buffer':32B 'describ':59B 'devic':37B 'endpoint':19B 'endpoint-manag':18B 'escal':25B 'exploit':66B 'heap':30B 'heap-bas':29B 'infrastructur':21B 'let':40B 'local':23B,53B 'local-privilege-escal':22B 'machin':54B 'manag':20B,38B 'mdm':26B,39B 'modern':36B 'overflow':33B 'privileg':24B,50B 'public':65B 'rais':48B 'remot':61B 'sourc':56B 'trigger':62B 'window':27B,35B","search_c":"'allow':78C 'attack':81C 'author':80C 'base':69C 'buffer':70C 'devic':75C 'elev':83C 'heap':68C 'heap-bas':67C 'local':85C 'manag':76C 'mdm':77C 'modern':74C 'overflow':71C 'privileg':84C 'window':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96184","severity":null,"published_at":"2026-11-10T19:22:18+00:00","modified_at":"2026-11-10T19:22:18+00:00","first_seen_at":"2026-11-10T19:25:33+00:00","fetched_at":"2026-11-10T19:25:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96184:2533","url":null,"severity":null,"published_at":"2026-11-10T19:40:06+00:00","modified_at":"2026-11-10T19:40:06+00:00","first_seen_at":"2026-11-10T19:40:06+00:00","fetched_at":"2026-11-10T19:40:06+00:00","note":"Could not retrieve the MSRC advisory (update-guide pages return empty) or any third-party page for this CVE; NVD fetch also empty. Affected builds, fixed KB and MDM precondition remain unknown. Nothing verified. Needs the MSRC page or Microsoft's November 2026 Patch Tuesday release notes (possible fix release date 2026-11-10, not confirmed). Do not confuse with sibling MDM CVE-2026-62707 (use-after-free, August)."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}