{"id":"CVE-2026-96864","published":"2026-10-13T19:22:00.717","lastModified":"2026-10-14T04:19:01.943","description":"Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-415"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96864","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A double free vulnerability in Microsoft Failover Cluster Virtual Driver allows unauthenticated remote code execution, where an attacker can free the same memory block twice, leading to potential arbitrary code execution with high privileges.","exploitability":"Exploitation is likely straightforward for a remote attacker with no authentication requirements, requiring only network access to the affected cluster service.","blast_radius":"The impact could be severe across enterprise environments using Microsoft Failover Clusters, potentially allowing attackers to gain full control over cluster nodes and compromise entire clustered systems.","remediation":"Apply the latest Windows Server Update Services (WSUS) patches or manually install the specific security update KB5042876 for Windows Server 2019 and Windows Server 2022, as this vulnerability affects the Failover Cluster Virtual Driver component.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","cluster","windows","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:51:33.808Z"}}