CVE-2026-96924
9.8CriticalPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-822
Impact
Unauthenticated attackers can execute arbitrary code remotely over the network with full system privileges. They need network connectivity to a vulnerable Windows host running an affected OLE listener.
Root cause
An untrusted pointer dereference in the Windows OLE implementation improperly handles network input.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Install the Microsoft security update for this CVE from Windows Update or the MSRC portal. If patching must wait, block untrusted inbound traffic to Windows RPC and OLE network ports at the perimeter firewall.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network.