PatchaPalooza

CVE-2026-96052: Windows Kernel Elevation of Privilege Vulnerability

CVE-2026-96052 is an elevation of privilege vulnerability in Windows Kernel, rated Important by Microsoft, with a CVSS 3.1 base score of 7.8 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as unlikely. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday, delivered through 8 security updates (KB5131096, KB5131090, KB5131087, KB5132061 and more). It affects 20 products in 2 product families (Windows, ESU).

Key facts

CVE ID
CVE-2026-96052
Severity
High CVSS 7.8
Microsoft severity
Important
Impact
Elevation of Privilege
Exploited in the wild
No
Publicly disclosed
No
Exploitation likelihood
Unlikely
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
November 2026 Patch Tuesday
Product families
Windows, ESU

CVSS score and vector

Microsoft scores CVE-2026-96052 at 7.8 (temporal 6.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

MetricValue
Attack vectorLocal
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit code maturityUnproven
Remediation levelOfficial fix
Report confidenceConfirmed

Description

Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to elevate privileges locally.

Frequently asked questions (Microsoft)

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Affected products (20)

Windows

ProductSecurity updateTypeFixed buildRestart
Windows 10 Version 21H2 for 32-bit SystemsKB5131096Security Update10.0.19044.7846Yes
Windows 10 Version 21H2 for ARM64-based SystemsKB5131096Security Update10.0.19044.7846Yes
Windows 10 Version 21H2 for x64-based SystemsKB5131096Security Update10.0.19044.7846Yes
Windows Server 2022KB5131090Security Update10.0.20348.5870Yes
Windows Server 2022 (Server Core installation)KB5131090Security Update10.0.20348.5870Yes
Windows 11 Version 23H2 for ARM64-based SystemsKB5131087Security Update10.0.22631.7711Yes
Windows 11 Version 23H2 for x64-based SystemsKB5131087Security Update10.0.22631.7711Yes
Windows 11 Version 24H2 for ARM64-based SystemsKB5132061
KB5132043		Security Update
Security Update		10.0.26100.9974
10.0.26100.9911		Yes
No
Windows 11 Version 24H2 for x64-based SystemsKB5132061
KB5132043		Security Update
Security Update		10.0.26100.9974
10.0.26100.9911		Yes
No
Windows 11 Version 25H2 for ARM64-based SystemsKB5132043Security Update10.0.26200.9911No
Windows 11 Version 25H2 for x64-based SystemsKB5132043Security Update10.0.26200.9911No
Windows 11 Version 26H2 for ARM64-based SystemsKB5132043Security Update10.0.26300.9911No
Windows 11 Version 26H2 for x64-based SystemsKB5132043Security Update10.0.26300.9911No
Windows Server 2025KB5131080
KB5131077		Security Update
Security Hotpatch Update		10.0.26100.33822
10.0.26100.33730		Yes
No
Windows Server 2025 (Server Core installation)KB5131080
KB5131077		Security Update
Security Hotpatch Update		10.0.26100.33822
10.0.26100.33730		Yes
No
Windows 11 Version 26H1 for ARM64-based SystemsKB5132059Security Update10.0.28000.3501Yes
Windows 11 version 26H1 for x64-based SystemsKB5132059Security Update10.0.28000.3501Yes

ESU

ProductSecurity updateTypeFixed buildRestart
Windows 10 Version 22H2 for 32-bit Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for x64-based Systems

Security updates (8)

Acknowledgments

  • Killer Queen

Revision history

VersionDateDescription
1.0Information published.

Sources