{"id":"CVE-2026-105495","kind":"vulnerability","aliases":["CVE-2026-105495"],"related":[],"title":"Windows: heap overflow in graphics platform lets local users gain admin rights","description":"Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Advanced Rasterization Platform, the graphics component behind Direct2D and DirectWrite, lets an attacker who already has a local account raise their privileges. The attacker gets SYSTEM-level control of the Windows machine.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows"],"not_affected_if":["single-user-trusted-machines"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:17:47+00:00","first_seen_at":"2026-11-10T19:24:14+00:00","triaged_at":"2026-11-10T19:34:16+00:00","updated_at":"2026-11-10T19:34:16+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:34:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: heap overflow in graphics platform lets local users gain admin rights","impact":"high","summary":"A heap-based buffer overflow in the Windows Advanced Rasterization Platform, the graphics component behind Direct2D and DirectWrite, lets an attacker who already has a local account raise their privileges. The attacker gets SYSTEM-level control of the Windows machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user becomes SYSTEM administrator on the Windows machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-105495 for affected Windows builds, the fixed update, and any workaround; the NVD record gives none.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-user-trusted-machines"],"who_is_affected":"Any Windows machine where an untrusted or low-privilege local user can run code is exposed, since the flaw needs an authorized local account. Servers and workstations with shared logons are the main concern. Machines with only trusted single users are lower risk, but the sources do not say which Windows builds are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":4502,"output_tokens":495,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-105495 for affected Windows builds, the fixed update, and any workaround; the NVD record gives none.","search":"'-105495':15A,18A '-2026':14A,17A 'account':48B 'admin':11A 'advanc':30B,70C 'allow':73C 'alreadi':44B 'attack':42B,53B,76C 'author':75C 'base':24B,65C 'behind':36B 'buffer':25B,66C 'compon':35B 'control':58B 'cve':13A,16A 'direct2d':37B 'directwrit':39B 'elev':78C 'gain':10A 'get':54B 'graphic':5A,34B 'heap':2A,23B,64C 'heap-bas':22B,63C 'infrastructur':19B 'let':7A,40B 'level':57B 'local':8A,47B,80C 'machin':62B 'overflow':3A,26B,67C 'platform':6A,32B,72C 'privileg':51B,79C 'rais':49B 'raster':31B,71C 'right':12A 'system':56B 'system-level':55B 'user':9A 'window':1A,20B,29B,61B,69C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine where an untrusted or low-privilege local user can run code is exposed, since the flaw needs an authorized local account. Servers and workstations with shared logons are the main concern. Machines with only trusted single users are lower risk, but the sources do not say which Windows builds are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows"],"campaign_type":null,"search_a":"'-105495':15A,18A '-2026':14A,17A 'admin':11A 'cve':13A,16A 'gain':10A 'graphic':5A 'heap':2A 'let':7A 'local':8A 'overflow':3A 'platform':6A 'right':12A 'user':9A 'window':1A","search_b":"'account':48B 'advanc':30B 'alreadi':44B 'attack':42B,53B 'base':24B 'behind':36B 'buffer':25B 'compon':35B 'control':58B 'direct2d':37B 'directwrit':39B 'get':54B 'graphic':34B 'heap':23B 'heap-bas':22B 'infrastructur':19B 'let':40B 'level':57B 'local':47B 'machin':62B 'overflow':26B 'platform':32B 'privileg':51B 'rais':49B 'raster':31B 'system':56B 'system-level':55B 'window':20B,29B,61B","search_c":"'advanc':70C 'allow':73C 'attack':76C 'author':75C 'base':65C 'buffer':66C 'elev':78C 'heap':64C 'heap-bas':63C 'local':80C 'overflow':67C 'platform':72C 'privileg':79C 'raster':71C 'window':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105495","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105495","severity":null,"published_at":"2026-11-10T19:17:47+00:00","modified_at":"2026-11-10T19:17:47+00:00","first_seen_at":"2026-11-10T19:24:14+00:00","fetched_at":"2026-11-10T19:24:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}