CVE-2026-96108

HighCVSS 7.8/10Last modified Oct 16, 2026

Description

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-961139.8Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.CVE-2026-961187.8Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-961199.9IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the syCVE-2026-96125.3The WhatsOrder – Instant Checkout for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up toCVE-2026-96134.3The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includiCVE-2026-96148.8An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain aCVE-2026-96154.3The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the liCVE-2026-96164.3The Generate Security.txt plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.12. This is dCVE-2026-96178.8PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a table and placing malicious codCVE-2026-961735.3The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting aCVE-2026-96184.3The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) plugin for WordPress is vulCVE-2026-961835.5Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose i
CVE-2026-96108: High severity, CVSS 7.8 | Vulnix