{"id":"CVE-2026-105020","kind":"vulnerability","aliases":["CVE-2026-105020"],"related":[],"title":"Windows: heap overflow in graphics platform lets local user gain admin rights","description":"Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Advanced Rasterization Platform, the graphics component of Windows, lets an attacker who already has a local account raise their privileges. The sources do not describe the trigger in more detail.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Advanced Rasterization Platform","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","windows"],"not_affected_if":["no-local-users"],"how_to_check":"- Check the Windows build with `winver` and compare it to the Microsoft security update for CVE-2026-105020","fix":null,"status":"open","published_at":"2026-11-10T19:17:42+00:00","first_seen_at":"2026-11-10T19:24:13+00:00","triaged_at":"2026-11-10T19:34:20+00:00","updated_at":"2026-11-10T19:34:20+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:34:20Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Windows: heap overflow in graphics platform lets local user gain admin rights","impact":"high","summary":"A heap-based buffer overflow in the Windows Advanced Rasterization Platform, the graphics component of Windows, lets an attacker who already has a local account raise their privileges. The sources do not describe the trigger in more detail.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM privileges on the machine","analyst_note":"Find the affected Windows builds and the Microsoft patch for CVE-2026-105020 at the MSRC advisory; NVD text alone gives no versions.","how_to_check":"- Check the Windows build with `winver` and compare it to the Microsoft security update for CVE-2026-105020\n- unknown","plain_action":"","product_name":"Windows Advanced Rasterization Platform","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Any Windows machine where a person or process can log in as a normal user is in scope, since the flaw needs only local authorized access. Shared workstations, terminal servers and build runners deserve priority. Machines with no untrusted local users are lower risk, but the sources do not say which Windows builds are affected.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00072,"input_tokens":4502,"output_tokens":539,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and the Microsoft patch for CVE-2026-105020 at the MSRC advisory; NVD text alone gives no versions.","search":"'-105020':15A,18A '-2026':14A,17A 'account':50B 'admin':11A 'advanc':34B,71C 'advanced':20A 'allow':74C 'alreadi':46B 'attack':44B,77C 'author':76C 'base':28B,66C 'buffer':29B,67C 'compon':39B 'cve':13A,16A 'describ':58B 'detail':63B 'elev':79C 'gain':10A 'graphic':5A,38B 'heap':2A,27B,65C 'heap-bas':26B,64C 'infrastructur':23B 'let':7A,42B 'local':8A,49B,81C 'overflow':3A,30B,68C 'platform':6A,22A,36B,73C 'privileg':53B,80C 'rais':51B 'raster':35B,72C 'rasterization':21A 'right':12A 'sourc':55B 'trigger':60B 'user':9A 'window':1A,24B,33B,41B,70C 'windows':19A","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine where a person or process can log in as a normal user is in scope, since the flaw needs only local authorized access. Shared workstations, terminal servers and build runners deserve priority. Machines with no untrusted local users are lower risk, but the sources do not say which Windows builds are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["advancedrasterizationplatform","windowsadvancedrasterizationplatform"],"ptokens":["advanced","platform","rasterization","windows"],"labels":["high","infrastructure","vendor","windows"],"campaign_type":null,"search_a":"'-105020':15A,18A '-2026':14A,17A 'admin':11A 'advanced':20A 'cve':13A,16A 'gain':10A 'graphic':5A 'heap':2A 'let':7A 'local':8A 'overflow':3A 'platform':6A,22A 'rasterization':21A 'right':12A 'user':9A 'window':1A 'windows':19A","search_b":"'account':50B 'advanc':34B 'alreadi':46B 'attack':44B 'base':28B 'buffer':29B 'compon':39B 'describ':58B 'detail':63B 'graphic':38B 'heap':27B 'heap-bas':26B 'infrastructur':23B 'let':42B 'local':49B 'overflow':30B 'platform':36B 'privileg':53B 'rais':51B 'raster':35B 'sourc':55B 'trigger':60B 'window':24B,33B,41B","search_c":"'advanc':71C 'allow':74C 'attack':77C 'author':76C 'base':66C 'buffer':67C 'elev':79C 'heap':65C 'heap-bas':64C 'local':81C 'overflow':68C 'platform':73C 'privileg':80C 'raster':72C 'window':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105020","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105020","severity":null,"published_at":"2026-11-10T19:17:42+00:00","modified_at":"2026-11-10T19:17:42+00:00","first_seen_at":"2026-11-10T19:24:13+00:00","fetched_at":"2026-11-10T19:24:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}