Ad · Leaderboard 728×90

CVE-2026-96186

7.8High

Published 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash

7.8High
Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None
Impact
Full C/I/A compromise
Weakness
CWE-502

Impact

A local attacker with standard user access can elevate privileges to SYSTEM. They need prior local execution privileges on the host.

Root cause

Insecure deserialization of untrusted data in Microsoft Windows Media Foundation.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Install the official Windows security update from the MSRC advisory; no interim workaround is provided.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-96186

Ad · Sticky 320×50 / 728×90