{"id":"CVE-2026-105025","kind":"vulnerability","aliases":["CVE-2026-105025"],"related":[],"title":"Windows: double free in graphics rasterizer lets local users gain privilege","description":"Double free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.","summary":"A double free bug in the Windows Advanced Rasterization Platform lets an already-authorized local user raise their privileges. An attacker who has a local account can gain higher rights on the affected Windows machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows"],"not_affected_if":["no-local-accounts"],"how_to_check":"- Check the installed Windows build with `winver` and compare it against Microsoft's update listing for CVE-2026-105025 (not stated in the sources).","fix":null,"status":"open","published_at":"2026-11-10T19:17:43+00:00","first_seen_at":"2026-11-10T19:24:14+00:00","triaged_at":"2026-11-10T19:42:45+00:00","updated_at":"2026-11-10T19:42:45+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:42:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: double free in graphics rasterizer lets local users gain privilege","impact":"high","summary":"A double free bug in the Windows Advanced Rasterization Platform lets an already-authorized local user raise their privileges. An attacker who has a local account can gain higher rights on the affected Windows machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the Windows machine","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-105025 to get affected Windows builds and the fixed update.","how_to_check":"- Check the installed Windows build with `winver` and compare it against Microsoft's update listing for CVE-2026-105025 (not stated in the sources).\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-accounts"],"who_is_affected":"Any Windows system where a user already has a local account is in scope, since the flaw needs an authorized attacker on the machine. The sources do not name affected Windows builds. Systems where only trusted administrators log in are lower risk but still need patching once a fix is listed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000695,"input_tokens":4490,"output_tokens":492,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-105025 to get affected Windows builds and the fixed update.","search":"'-105025':14A,17A '-2026':13A,16A 'account':46B 'advanc':27B,60C 'affect':53B 'allow':63C 'alreadi':33B 'already-author':32B 'attack':41B,66C 'author':34B,65C 'bug':23B 'cve':12A,15A 'doubl':2A,21B,56C 'elev':68C 'free':3A,22B,57C 'gain':10A,48B 'graphic':5A 'higher':49B 'infrastructur':18B 'let':7A,30B 'local':8A,35B,45B,70C 'machin':55B 'platform':29B,62C 'privileg':11A,39B,69C 'rais':37B 'raster':6A,28B,61C 'right':50B 'user':9A,36B 'window':1A,19B,26B,54B,59C","nicknames":[],"mitigations":[],"who_affected":"Any Windows system where a user already has a local account is in scope, since the flaw needs an authorized attacker on the machine. The sources do not name affected Windows builds. Systems where only trusted administrators log in are lower risk but still need patching once a fix is listed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows"],"campaign_type":null,"search_a":"'-105025':14A,17A '-2026':13A,16A 'cve':12A,15A 'doubl':2A 'free':3A 'gain':10A 'graphic':5A 'let':7A 'local':8A 'privileg':11A 'raster':6A 'user':9A 'window':1A","search_b":"'account':46B 'advanc':27B 'affect':53B 'alreadi':33B 'already-author':32B 'attack':41B 'author':34B 'bug':23B 'doubl':21B 'free':22B 'gain':48B 'higher':49B 'infrastructur':18B 'let':30B 'local':35B,45B 'machin':55B 'platform':29B 'privileg':39B 'rais':37B 'raster':28B 'right':50B 'user':36B 'window':19B,26B,54B","search_c":"'advanc':60C 'allow':63C 'attack':66C 'author':65C 'doubl':56C 'elev':68C 'free':57C 'local':70C 'platform':62C 'privileg':69C 'raster':61C 'window':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105025","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105025","severity":null,"published_at":"2026-11-10T19:17:43+00:00","modified_at":"2026-11-10T19:17:43+00:00","first_seen_at":"2026-11-10T19:24:14+00:00","fetched_at":"2026-11-10T19:24:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}