{"id":"CVE-2026-95901","published":"2026-11-10T19:21:43.510","lastModified":"2026-11-11T05:19:55.997","description":"Double free in Windows Microsoft DirectMusic allows an unauthorized attacker to execute code over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-415"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95901","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A double free vulnerability exists in Windows Microsoft DirectMusic, where repeated deallocation of the same memory region can corrupt heap structures. This flaw enables remote code execution (RCE) without authentication or user interaction over the network.","exploitability":"Exploitation requires network-level access to a vulnerable DirectMusic service; while no public exploit is known, the CVSS score and lack of authentication requirements indicate high exploitability potential for skilled attackers.","blast_radius":"Successful exploitation could allow full system compromise (confidentiality, integrity, availability loss) on affected Windows systems, potentially enabling lateral movement or persistent access across enterprise networks.","remediation":"No fixed version is published in the description; disable Microsoft DirectMusic functionality via Group Policy or registry settings, restrict network exposure of services using DirectMusic, and apply all available Windows security updates immediately.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","heap-corruption","double-free","network-exploitable","windows","cwe-415"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:52:00.356Z"}}