Microsoft Windows User Manager Service: Elevation of privilege via heap buffer overflow
Summary
A heap-based buffer overflow in the Windows User Manager Service allows a local user with low privileges to elevate their privileges. No user interaction is needed, and the CVSS 3.1 score of 7.8 is Microsoft's CNA score. An attacker must already have code execution or a logged-on session on the host, so this is a second-stage risk rather than an entry point. Successful exploitation would give full control of the affected host.
Affected
- Windows 10 Version 1607, 1809, 21H2, 22H2
- Windows 11 Version 23H2, 24H2, 25H2, 26H1, 26H2
- Windows Server 2016, 2019, 2022 (including Server Core installations)
- Build ranges per Microsoft CNA record; some builds are unverified (see sources).
Fixed in
- Windows 10 1607: 10.0.14393.9688
- Windows 10 1809: 10.0.17763.9487
- Windows 10 21H2: 10.0.19044.7846
- Windows 10 22H2: 10.0.19045.7846 (from third-party mirror, unverified)
- Windows 11 23H2: 10.0.22631.7711 (from third-party mirror, unverified)
- Windows 11 24H2: 10.0.26100.9974 (from third-party mirror, unverified)
- Windows Server 2016: 10.0.14393.9688
- Windows Server 2019: 10.0.17763.9487
- Windows Server 2022: 10.0.20348.5870 (from third-party mirror, unverified)
- Check the MSRC advisory for the KB number for each build. Unknown for Windows 11 and Server KB numbers.
Workaround
Unknown. No workaround or mitigation is documented in the sources reviewed.
Exploitation
- Exploited in the wild: no evidence found.
- Exploit code maturity: Unproven (E:U).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- CISA KEV: not listed in the latest update found.
- Public proof of concept: none found.
Our recommendation
- Patch affected Windows 10, 11 and Server systems in the next regular cycle, and prioritise multi-user servers, Remote Desktop hosts and shared workstations.
- Verify the exact build numbers and KB numbers in the MSRC advisory before rollout.
- Identify older builds (1607, 1809, 21H2) in your fleet and confirm their support status with Microsoft.
- Limit local logon rights and reduce code execution for standard users as interim measures.
- Monitor for unusual privilege changes on hosts.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows User Manager Service
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center advisory CVE-2026-96037 msrc.microsoft.com
- CVE.org record CVE-2026-96037 www.cve.org
- Third-party mirror CVE-2026-96037 (unverified) www.strix.ai
- Windows update KB5131096 (unverified link to this CVE) senserva.com
- CISA KEV alert 13 Oct 2026 (latest found, predates this CVE) www.cisa.gov
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:45.
Original description (NVD)
Heap-based buffer overflow in Windows User Manager Service allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.