IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Windows OLE: Use after free leads to information disclosure

CVE-2026-96110Medium 5.5

← All vulnerabilities

Summary

A use-after-free weakness in the Windows OLE component allows an authorized local attacker to read information from memory. The attacker needs a local account with low privileges, and the impact is limited to confidentiality. The flaw is not reachable from the internet, but a leaked memory content could help an attacker who already runs code on a machine.

Affected

  • Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9688
  • Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
  • Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
  • Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
  • Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
  • Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
  • Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
  • Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
  • Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
  • Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
  • Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
  • Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870

Note: Aggregator sources list different build data for Windows 10 21H2. Verify against the MSRC table.

Fixed in

  • Fixed in the November 2026 Patch Tuesday release through the regular Windows cumulative updates.
  • Fixed builds according to the CVE record: 10.0.14393.9688, 10.0.17763.9487, 10.0.22631.7711, 10.0.26200.9974.
  • Reported cumulative update numbers (unverified): KB5132061 (Windows 11 24H2/25H2/26H2), KB5131087 (Windows 11 23H2), KB5131090 (Windows Server 2022). Confirm them in the Microsoft Update Catalog.

Workaround

  • Unknown. No workaround was found in the sources. Installing the fix is the remedy.

Exploitation

  • Not known to be exploited in the wild.
  • Exploit code maturity is rated Unproven (E:U) in the CVE record.
  • Not listed in CISA's Known Exploited Vulnerabilities catalog.
  • Public proof of concept: unknown. No public exploit or write-up was found.

Our recommendation

  • Install the November 2026 Windows updates on all affected systems through the regular update cycle.
  • Prioritise systems on the older builds listed above and hosts where users open untrusted documents.
  • Check which Windows build and support status each system has.
  • Verify the fixed builds on the MSRC advisory before rollout.
  • Monitor CISA KEV and public exploit sources for changes in exploitation status.

Information from Microsoft (Patch Tuesday November 2026)

Severity (Microsoft)
Important
Impact
Information disclosure – Windows OLE
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:31.

Original description (NVD)

Use after free in Windows OLE allows an authorized attacker to disclose information locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed