CVE WatchNov 10, 2026

CVE-2026-96019

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attack

CVSS

7.0

High

EPSS

—

KEV

—

Exploit Today

0-100

Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-362 · CWE-822

EPSS · 30d

Not enough EPSS history yet.

Technical description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

Official references

msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96019

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-961717.0 HIG

—

——0Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.4h CVE-2026-961687.0 HIG

—

——0Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.4h CVE-2026-961587.0 HIG

—

——0Use of uninitialized resource in Microsoft ActiveX Installer Service allows an authorized attacker to elevate privileges locally.4h CVE-2026-961397.0 HIG

—

——0Untrusted pointer dereference in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.4h CVE-2026-961247.0 HIG

—

——0Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.4h CVE-2026-961227.8 HIG

—

——0Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.4h