{"id":"CVE-2026-96971","kind":"vulnerability","aliases":["CVE-2026-96971"],"related":[],"title":"Windows NetBIOS: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally.","summary":"Use-after-free in the Windows NetBIOS component lets a local attacker with a low-privileged account elevate privileges (CVSS 3.1 7.0, AV:L/AC:H/PR:L). Microsoft lists Windows 10, Windows 11 and Windows Server 2016 to 2025 builds below the fixed builds as affected. No exploitation reported in the sources read.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows NetBIOS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local","netbios","privilege-escalation","windows"],"not_affected_if":["unknown"],"how_to_check":"Run winver or cmd /c ver and compare the build (e.g. Windows 11 24H2 must be 10.0.26100.9974 or later; Server 2022 10.0.20348.5870 or later; Server 2025 10.0.26100.33822 or later). Full list in the product rows.","fix":"Install the November 2026 Windows cumulative update that raises the build to at least the fixed build for your version (see product rows). Microsoft's MSRC page was not readable, so confirm the KB there.","status":"open","published_at":"2026-11-10T19:22:19+00:00","first_seen_at":"2026-11-10T19:25:33+00:00","triaged_at":"2026-11-10T19:48:03+00:00","updated_at":"2026-11-10T19:50:48+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:48:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows NetBIOS: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in the Windows NetBIOS component lets an attacker who already has a local account raise their privileges. The sources give a CVSS score of 7.0 and no details on the exact trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","netbios"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains elevated system privileges on the machine","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows versions, fixed builds and any mitigation for NetBIOS.","how_to_check":"- unknown","plain_action":"","product_name":"Windows NetBIOS","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Windows machines with NetBIOS enabled are the affected systems per the NVD entry. An attacker must already be authorized on the machine, so shared hosts and multi-user systems carry the most exposure. The sources do not say which Windows versions or configurations are affected.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000686,"input_tokens":4480,"output_tokens":475,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows versions, fixed builds and any mitigation for NetBIOS.","search":"'-2026':15A,18A '-96971':16A,19A '10':23A,28A,33A,36A,97B '11':39A,42A,45A,48A,51A,99B '1607':24A '1809':29A '2016':26A,103B '2019':31A '2022':55A '2025':58A,105B '21h2':34A '22h2':37A '23h2':40A '24h2':43A '25h2':46A '26h1':49A '26h2':52A '3.1':88B '7.0':89B 'account':84B 'affect':112B 'allow':126C 'attack':78B,129C 'author':128C 'av':90B 'build':106B,110B 'compon':74B 'cve':14A,17A 'cvss':87B 'elev':85B,131C 'escal':64B 'exploit':114B 'fix':109B 'free':6A,69B,122C 'gain':11A 'h/pr':92B 'higher':12A 'infrastructur':59B 'l':93B 'l/ac':91B 'let':7A,75B 'list':95B 'local':9A,60B,77B,133C 'low':82B 'low-privileg':81B 'microsoft':94B 'netbio':2A,61B,73B,125C 'netbios':21A 'privileg':13A,63B,83B,86B,132C 'privilege-escal':62B 'read':119B 'report':115B 'server':25A,30A,54A,57A,102B 'sourc':118B 'use':4A,67B,120C 'use-after-fre':3A,66B 'user':10A 'window':1A,65B,72B,96B,98B,101B,124C 'windows':20A,22A,27A,32A,35A,38A,41A,44A,47A,50A,53A,56A","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10 (1607 to 22H2), Windows 11 (23H2 to 26H2) or Windows Server 2016/2019/2022/2025 machine below the fixed build. It needs a local account, so shared machines, terminal servers, VDI and CI runners matter most; single-user machines with no untrusted local code are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","netbios","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsnetbios","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","netbios","server","windows"],"labels":["high","infrastructure","local","netbios","privilegeescalation","vendor","windows"],"campaign_type":null,"search_a":"'-2026':15A,18A '-96971':16A,19A '10':23A,28A,33A,36A '11':39A,42A,45A,48A,51A '1607':24A '1809':29A '2016':26A '2019':31A '2022':55A '2025':58A '21h2':34A '22h2':37A '23h2':40A '24h2':43A '25h2':46A '26h1':49A '26h2':52A 'cve':14A,17A 'free':6A 'gain':11A 'higher':12A 'let':7A 'local':9A 'netbio':2A 'netbios':21A 'privileg':13A 'server':25A,30A,54A,57A 'use':4A 'use-after-fre':3A 'user':10A 'window':1A 'windows':20A,22A,27A,32A,35A,38A,41A,44A,47A,50A,53A,56A","search_b":"'10':97B '11':99B '2016':103B '2025':105B '3.1':88B '7.0':89B 'account':84B 'affect':112B 'attack':78B 'av':90B 'build':106B,110B 'compon':74B 'cvss':87B 'elev':85B 'escal':64B 'exploit':114B 'fix':109B 'free':69B 'h/pr':92B 'infrastructur':59B 'l':93B 'l/ac':91B 'let':75B 'list':95B 'local':60B,77B 'low':82B 'low-privileg':81B 'microsoft':94B 'netbio':61B,73B 'privileg':63B,83B,86B 'privilege-escal':62B 'read':119B 'report':115B 'server':102B 'sourc':118B 'use':67B 'use-after-fre':66B 'window':65B,72B,96B,98B,101B","search_c":"'allow':126C 'attack':129C 'author':128C 'elev':131C 'free':122C 'local':133C 'netbio':125C 'privileg':132C 'use':120C 'window':124C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96971","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96971","severity":null,"published_at":"2026-11-10T19:22:19+00:00","modified_at":"2026-11-10T19:22:19+00:00","first_seen_at":"2026-11-10T19:25:33+00:00","fetched_at":"2026-11-10T19:25:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96971:2561","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96971","severity":null,"published_at":"2026-11-10T19:50:48+00:00","modified_at":"2026-11-10T19:50:48+00:00","first_seen_at":"2026-11-10T19:50:48+00:00","fetched_at":"2026-11-10T19:50:48+00:00","note":"NVD (Microsoft CNA data) gives affected/fixed builds; MSRC page is JS-only and returned nothing via web-cli, so nothing marked verified. No exploitation or PoC found in sources; did not search social.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-96971"]}],"documents":[{"id":117702,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96971","title":"NVD CVE-2026-96971 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}