{"id":"CVE-2026-105021","kind":"vulnerability","aliases":["CVE-2026-105021"],"related":[],"title":"Windows: heap overflow in graphics platform lets a local user gain privileges","description":"Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Advanced Rasterization Platform, the graphics component, can be triggered by an authorized local user. An attacker who can already log on can use it to raise their privileges.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Advanced Rasterization Platform","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","windows"],"not_affected_if":["no-local-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:17:42+00:00","first_seen_at":"2026-11-10T19:24:13+00:00","triaged_at":"2026-11-10T19:34:19+00:00","updated_at":"2026-11-10T19:34:19+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:34:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: heap overflow in graphics platform lets a local user gain privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Advanced Rasterization Platform, the graphics component, can be triggered by an authorized local user. An attacker who can already log on can use it to raise their privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Confirm affected Windows builds and the Microsoft fixed version from the MSRC advisory for CVE-2026-105021.","how_to_check":"unknown","plain_action":"","product_name":"Windows Advanced Rasterization Platform","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Systems running Windows where a user already has a local account can be exploited through this flaw. The sources do not say which Windows builds are affected or whether any configuration is required. Servers and workstations with no untrusted local users are lower risk.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":4502,"output_tokens":462,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Windows builds and the Microsoft fixed version from the MSRC advisory for CVE-2026-105021.","search":"'-105021':15A,18A '-2026':14A,17A 'advanc':34B,69C 'advanced':20A 'allow':72C 'alreadi':52B 'attack':49B,75C 'author':45B,74C 'base':28B,64C 'buffer':29B,65C 'compon':39B 'cve':13A,16A 'elev':77C 'gain':11A 'graphic':5A,38B 'heap':2A,27B,63C 'heap-bas':26B,62C 'infrastructur':23B 'let':7A 'local':9A,46B,79C 'log':53B 'overflow':3A,30B,66C 'platform':6A,22A,36B,71C 'privileg':12A,61B,78C 'rais':59B 'raster':35B,70C 'rasterization':21A 'trigger':42B 'use':56B 'user':10A,47B 'window':1A,24B,33B,68C 'windows':19A","nicknames":[],"mitigations":[],"who_affected":"Systems running Windows where a user already has a local account can be exploited through this flaw. The sources do not say which Windows builds are affected or whether any configuration is required. Servers and workstations with no untrusted local users are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["advancedrasterizationplatform","windowsadvancedrasterizationplatform"],"ptokens":["advanced","platform","rasterization","windows"],"labels":["high","infrastructure","vendor","windows"],"campaign_type":null,"search_a":"'-105021':15A,18A '-2026':14A,17A 'advanced':20A 'cve':13A,16A 'gain':11A 'graphic':5A 'heap':2A 'let':7A 'local':9A 'overflow':3A 'platform':6A,22A 'privileg':12A 'rasterization':21A 'user':10A 'window':1A 'windows':19A","search_b":"'advanc':34B 'alreadi':52B 'attack':49B 'author':45B 'base':28B 'buffer':29B 'compon':39B 'graphic':38B 'heap':27B 'heap-bas':26B 'infrastructur':23B 'local':46B 'log':53B 'overflow':30B 'platform':36B 'privileg':61B 'rais':59B 'raster':35B 'trigger':42B 'use':56B 'user':47B 'window':24B,33B","search_c":"'advanc':69C 'allow':72C 'attack':75C 'author':74C 'base':64C 'buffer':65C 'elev':77C 'heap':63C 'heap-bas':62C 'local':79C 'overflow':66C 'platform':71C 'privileg':78C 'raster':70C 'window':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105021","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105021","severity":null,"published_at":"2026-11-10T19:17:42+00:00","modified_at":"2026-11-10T19:17:42+00:00","first_seen_at":"2026-11-10T19:24:13+00:00","fetched_at":"2026-11-10T19:24:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}