{"id":"CVE-2026-96969","kind":"vulnerability","aliases":["CVE-2026-96969"],"related":[],"title":"Windows TCP/IP: double free lets a local user gain higher privileges","description":"Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.","summary":"A double free bug in the Windows TCP/IP networking stack lets an attacker who already has a local account raise their privileges. The sources do not say which Windows versions are affected or what fix Microsoft shipped.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","tcp-ip","windows"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":"Unknown: affected Windows builds not read from a primary source. Look up CVE-2026-96969 in the Microsoft Security Update Guide, then compare your build (winver) with the listed KB and confirm it is installed (Get-HotFix).","fix":null,"status":"open","published_at":"2026-11-10T19:22:18+00:00","first_seen_at":"2026-11-10T19:25:33+00:00","triaged_at":"2026-11-10T19:48:04+00:00","updated_at":"2026-11-10T19:50:23+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:48:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows TCP/IP: double free lets a local user gain higher privileges","impact":"high","summary":"A double free bug in the Windows TCP/IP networking stack lets an attacker who already has a local account raise their privileges. The sources do not say which Windows versions are affected or what fix Microsoft shipped.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","tcp-ip"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-96969 for affected Windows builds and the patch.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Windows machines that let untrusted people log on locally are the systems at risk, since the attacker must already be authorized on the machine. The sources do not list affected Windows builds, so check the vendor advisory for the exact versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":4478,"output_tokens":433,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-96969 for affected Windows builds and the patch.","search":"'-2026':13A,16A '-96969':14A,17A 'account':45B 'affect':58B 'allow':69C 'alreadi':41B 'attack':39B,72C 'author':71C 'bug':30B 'cve':12A,15A 'doubl':3A,28B,64C 'elev':74C 'escal':22B 'fix':61B 'free':4A,29B,65C 'gain':9A 'higher':10A 'infrastructur':18B 'ip':25B 'let':5A,37B 'local':7A,20B,44B,76C 'local-privilege-escal':19B 'microsoft':62B 'network':35B 'privileg':11A,21B,48B,75C 'rais':46B 'say':53B 'ship':63B 'sourc':50B 'stack':36B 'tcp':24B 'tcp-ip':23B 'tcp/ip':2A,34B,68C 'user':8A 'version':56B 'window':1A,26B,33B,55B,67C","nicknames":[],"mitigations":[],"who_affected":"Windows machines that let untrusted people log on locally are the systems at risk, since the attacker must already be authorized on the machine. The sources do not list affected Windows builds, so check the vendor advisory for the exact versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","tcpip","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-96969':14A,17A 'cve':12A,15A 'doubl':3A 'free':4A 'gain':9A 'higher':10A 'let':5A 'local':7A 'privileg':11A 'tcp/ip':2A 'user':8A 'window':1A","search_b":"'account':45B 'affect':58B 'alreadi':41B 'attack':39B 'bug':30B 'doubl':28B 'escal':22B 'fix':61B 'free':29B 'infrastructur':18B 'ip':25B 'let':37B 'local':20B,44B 'local-privilege-escal':19B 'microsoft':62B 'network':35B 'privileg':21B,48B 'rais':46B 'say':53B 'ship':63B 'sourc':50B 'stack':36B 'tcp':24B 'tcp-ip':23B 'tcp/ip':34B 'version':56B 'window':26B,33B,55B","search_c":"'allow':69C 'attack':72C 'author':71C 'doubl':64C 'elev':74C 'free':65C 'local':76C 'privileg':75C 'tcp/ip':68C 'window':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96969","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96969","severity":null,"published_at":"2026-11-10T19:22:18+00:00","modified_at":"2026-11-10T19:22:19+00:00","first_seen_at":"2026-11-10T19:25:33+00:00","fetched_at":"2026-11-10T19:25:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96969:2562","url":null,"severity":null,"published_at":"2026-11-10T19:50:23+00:00","modified_at":"2026-11-10T19:50:23+00:00","first_seen_at":"2026-11-10T19:50:23+00:00","fetched_at":"2026-11-10T19:50:23+00:00","note":"Could not read MSRC entry (JS-only page, browser session died; NVD page gave no details). No affected builds or KB/fix confirmed; nothing verified. Revisit when MSRC text is reachable. X/search not tried."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}