{"id":"CVE-2026-105497","kind":"vulnerability","aliases":["CVE-2026-105497"],"related":[],"title":"Windows Advanced Rasterization Platform (WARP): heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Advanced Rasterization Platform, a Windows graphics component, lets an attacker who already has authorized local access raise their privileges. The sources rate it high severity (CVSS 8.8) and do not name a public exploit.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9376"],"affected":"< 10.0.17763.9376","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7807"],"affected":"< 10.0.19044.7807","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7807"],"affected":"< 10.0.19045.7807","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7652"],"affected":"< 10.0.22631.7652","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9711"],"affected":"< 10.0.26100.9711","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9711"],"affected":"< 10.0.26200.9711","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3231"],"affected":"< 10.0.28000.3231","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9711"],"affected":"< 10.0.26300.9711","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5761"],"affected":"< 10.0.20348.5761","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33650"],"affected":"< 10.0.26100.33650","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows","windows-server"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"Run winver or PowerShell [System.Environment]::OSVersion.Version (or cmd 'ver') and compare the build.revision with the fixed build for your Windows version; lower means exposed.","fix":"Install the November 2026 Windows cumulative update that brings your build to at least the fixed build: Win10 1809/Server 2019 10.0.17763.9376; Win10 21H2 10.0.19044.7807; Win10 22H2 10.0.19045.7807; Win11 23H2 10.0.22631.7652; Win11 24H2 10.0.26100.9711; Win11 25H2 10.0.26200.9711; Win11 26H1 10.0.28000.3231; Win11 26H2 10.0.26300.9711; Server 2022 10.0.20348.5761; Server 2025 10.0.26100.33650. KB numbers not confirmed.","status":"open","published_at":"2026-11-10T19:17:47+00:00","first_seen_at":"2026-11-10T19:24:14+00:00","triaged_at":"2026-11-10T19:34:09+00:00","updated_at":"2026-11-11T01:06:55+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-10T19:34:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: heap buffer overflow lets a logged-in user gain system privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Advanced Rasterization Platform, a Windows graphics component, lets an attacker who already has authorized local access raise their privileges. The sources rate it high severity (CVSS 8.8) and do not name a public exploit.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the Windows machine","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-105497 to confirm affected Windows builds and the fixed update.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Any Windows machine with the affected Windows Advanced Rasterization Platform component is exposed to a user who already has a local account. The sources do not list affected Windows builds or whether a server or workstation role changes exposure. Teams that rely on Windows hosts with many local users should treat this as a priority to patch once Microsoft publishes a fix.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000696,"input_tokens":4502,"output_tokens":492,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-105497 to confirm affected Windows builds and the fixed update.","search":"'-105497':17A,20A '-2026':16A,19A '10':22A,27A,30A '11':33A,36A,39A,42A,45A '1809':23A '2019':25A '2022':49A '2025':52A '21h2':28A '22h2':31A '23h2':34A '24h2':37A '25h2':40A '26h1':43A '26h2':46A '8.8':97B 'access':86B 'advanc':2A,71B,112C 'allow':115C 'alreadi':82B 'attack':80B,118C 'author':84B,117C 'base':65B,107C 'buffer':66B,108C 'compon':77B 'cve':15A,18A 'cvss':96B 'elev':120C 'escal':57B 'exploit':104B 'gain':12A 'graphic':76B 'heap':6A,64B,106C 'heap-bas':63B,105C 'high':94B 'higher':13A 'infrastructur':53B 'let':8A,78B 'local':10A,55B,85B,122C 'local-privilege-escal':54B 'name':101B 'overflow':7A,67B,109C 'platform':4A,73B,114C 'privileg':14A,56B,89B,121C 'public':103B 'rais':87B 'raster':3A,72B,113C 'rate':92B 'server':24A,48A,51A,61B 'sever':95B 'sourc':91B 'user':11A 'warp':5A 'window':1A,58B,60B,70B,75B,111C 'windows':21A,26A,29A,32A,35A,38A,41A,44A,47A,50A 'windows-serv':59B","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10, Windows 11 or Windows Server 2019/2022/2025 machine below the fixed build is affected. An attacker needs to already run code as a local low-privilege user, then can gain higher privileges through the rasterization component. Shared machines, terminal/RDP servers, build agents and CI runners matter most; single-user machines with no untrusted local code are lower priority.","tier":"B","verified":{"fix":{"at":"2026-11-11T01:06:55Z","by":"analyst","doc":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105497","run_id":3465},"products":{"at":"2026-11-11T01:06:55Z","by":"analyst","doc":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105497","run_id":3465},"who_affected":{"at":"2026-11-11T01:06:55Z","by":"analyst","doc":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105497","run_id":3465}},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Install the latest Windows updates: Settings > Windows Update > Check for updates, then restart.","pkeys":["101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1809","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","windows","windowsserver"],"campaign_type":null,"search_a":"'-105497':17A,20A '-2026':16A,19A '10':22A,27A,30A '11':33A,36A,39A,42A,45A '1809':23A '2019':25A '2022':49A '2025':52A '21h2':28A '22h2':31A '23h2':34A '24h2':37A '25h2':40A '26h1':43A '26h2':46A 'advanc':2A 'cve':15A,18A 'gain':12A 'heap':6A 'higher':13A 'let':8A 'local':10A 'overflow':7A 'platform':4A 'privileg':14A 'raster':3A 'server':24A,48A,51A 'user':11A 'warp':5A 'window':1A 'windows':21A,26A,29A,32A,35A,38A,41A,44A,47A,50A","search_b":"'8.8':97B 'access':86B 'advanc':71B 'alreadi':82B 'attack':80B 'author':84B 'base':65B 'buffer':66B 'compon':77B 'cvss':96B 'escal':57B 'exploit':104B 'graphic':76B 'heap':64B 'heap-bas':63B 'high':94B 'infrastructur':53B 'let':78B 'local':55B,85B 'local-privilege-escal':54B 'name':101B 'overflow':67B 'platform':73B 'privileg':56B,89B 'public':103B 'rais':87B 'raster':72B 'rate':92B 'server':61B 'sever':95B 'sourc':91B 'window':58B,60B,70B,75B 'windows-serv':59B","search_c":"'advanc':112C 'allow':115C 'attack':118C 'author':117C 'base':107C 'buffer':108C 'elev':120C 'heap':106C 'heap-bas':105C 'local':122C 'overflow':109C 'platform':114C 'privileg':121C 'raster':113C 'window':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105497","severity":null,"published_at":"2026-11-10T19:17:47+00:00","modified_at":"2026-11-10T19:17:47+00:00","first_seen_at":"2026-11-10T19:24:14+00:00","fetched_at":"2026-11-10T19:24:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105497:3465","url":"https://cveawg.mitre.org/api/cve/CVE-2026-105497","severity":null,"published_at":"2026-11-11T01:06:55+00:00","modified_at":"2026-11-11T01:06:55+00:00","first_seen_at":"2026-11-11T01:06:55+00:00","fetched_at":"2026-11-11T01:06:55+00:00","note":"Read Microsoft's own CVE record (CNA, cveawg); MSRC page is JS-only so KB numbers not read. Builds and fixed builds from CNA record. CISA SSVC: exploitation none, not automatable. No PoC found.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-105497","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105497"]}],"documents":[{"id":121209,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-105497","title":"CVE-2026-105497 CVE record published by Microsoft (CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":121210,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105497","title":"MSRC: Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability (page needs JavaScript)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}