---
id: "CVE-2026-96971"
page: "https://infrastack.ai/live/CVE-2026-96971"
kind: "vulnerability"
aliases: ["CVE-2026-96971"]
title: "Windows NetBIOS: use-after-free lets a local user gain higher privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows NetBIOS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Windows 10 1607 / Server 2016", "fixed": ["10.0.14393.9688"], "affected": "< 10.0.14393.9688", "ecosystem": "vendor"}, {"name": "Windows 10 1809 / Server 2019", "fixed": ["10.0.17763.9487"], "affected": "< 10.0.17763.9487", "ecosystem": "vendor"}, {"name": "Windows 10 21H2", "fixed": ["10.0.19044.7846"], "affected": "< 10.0.19044.7846", "ecosystem": "vendor"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": "< 10.0.19045.7846", "ecosystem": "vendor"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": "< 10.0.22631.7711", "ecosystem": "vendor"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": "< 10.0.26100.9974", "ecosystem": "vendor"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9974"], "affected": "< 10.0.26200.9974", "ecosystem": "vendor"}, {"name": "Windows 11 26H1", "fixed": ["10.0.28000.3501"], "affected": "< 10.0.28000.3501", "ecosystem": "vendor"}, {"name": "Windows 11 26H2", "fixed": ["10.0.26300.9974"], "affected": "< 10.0.26300.9974", "ecosystem": "vendor"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": "< 10.0.20348.5870", "ecosystem": "vendor"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": "< 10.0.26100.33822", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "local", "netbios", "privilege-escalation", "windows"]
not_affected_if: ["unknown"]
published_at: "2026-11-10T19:22:19+00:00"
first_seen_at: "2026-11-10T19:25:33+00:00"
updated_at: "2026-11-10T19:50:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96971", "first_seen_at": "2026-11-10T19:25:33+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96971", "first_seen_at": "2026-11-10T19:50:48+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-96971"]}]
exploit_sources: []
---

# Windows NetBIOS: use-after-free lets a local user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-96971 (this .md is for agents)

Use-after-free in the Windows NetBIOS component lets a local attacker with a low-privileged account elevate privileges (CVSS 3.1 7.0, AV:L/AC:H/PR:L). Microsoft lists Windows 10, Windows 11 and Windows Server 2016 to 2025 builds below the fixed builds as affected. No exploitation reported in the sources read.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows NetBIOS affected range not listed fixed no fixed version listed
- vendor:Windows 10 1607 / Server 2016 affected < 10.0.14393.9688 fixed 10.0.14393.9688
- vendor:Windows 10 1809 / Server 2019 affected < 10.0.17763.9487 fixed 10.0.17763.9487
- vendor:Windows 10 21H2 affected < 10.0.19044.7846 fixed 10.0.19044.7846
- vendor:Windows 10 22H2 affected < 10.0.19045.7846 fixed 10.0.19045.7846
- vendor:Windows 11 23H2 affected < 10.0.22631.7711 fixed 10.0.22631.7711
- vendor:Windows 11 24H2 affected < 10.0.26100.9974 fixed 10.0.26100.9974
- vendor:Windows 11 25H2 affected < 10.0.26200.9974 fixed 10.0.26200.9974
- vendor:Windows 11 26H1 affected < 10.0.28000.3501 fixed 10.0.28000.3501
- vendor:Windows 11 26H2 affected < 10.0.26300.9974 fixed 10.0.26300.9974
- vendor:Windows Server 2022 affected < 10.0.20348.5870 fixed 10.0.20348.5870
- vendor:Windows Server 2025 affected < 10.0.26100.33822 fixed 10.0.26100.33822

## How to check

Run winver or cmd /c ver and compare the build (e.g. Windows 11 24H2 must be 10.0.26100.9974 or later; Server 2022 10.0.20348.5870 or later; Server 2025 10.0.26100.33822 or later). Full list in the product rows.

## Fix

Install the November 2026 Windows cumulative update that raises the build to at least the fixed build for your version (see product rows). Microsoft's MSRC page was not readable, so confirm the KB there.

## Timeline

- 2026-11-10T19:25:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96971
- 2026-11-10T19:50:48+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-96971 — NVD (Microsoft CNA data) gives affected/fixed builds; MSRC page is JS-only and returned nothing via web-cli, so nothing marked verified. No exploitation or PoC found in sources; did not search social.

## Documents

- [describes] NVD CVE-2026-96971 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/CVE-2026-96971

## From the sources

Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_