{"id":"CVE-2026-105499","kind":"vulnerability","aliases":["CVE-2026-105499"],"related":[],"title":"Windows: out-of-bounds read in graphics platform lets a local user gain privileges","description":"Out-of-bounds read in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.","summary":"A flaw in the Windows Advanced Rasterization Platform, a graphics component, reads memory outside its bounds. An authorized local attacker can use it to elevate privileges on the machine.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Advanced Rasterization Platform","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:17:48+00:00","first_seen_at":"2026-11-10T19:24:14+00:00","triaged_at":"2026-11-10T19:34:08+00:00","updated_at":"2026-11-10T19:34:08+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:34:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: out-of-bounds read in graphics platform lets a local user gain privileges","impact":"high","summary":"A flaw in the Windows Advanced Rasterization Platform, a graphics component, reads memory outside its bounds. An authorized local attacker can use it to elevate privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the machine","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-105499 to confirm affected Windows builds and the patch.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Advanced Rasterization Platform","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines where a user already has a local account can be affected by this local privilege escalation. The sources do not say which Windows builds are affected, and the NVD entry does not list fixed versions. Systems where only trusted administrators log in carry less exposure.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4501,"output_tokens":455,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-105499 to confirm affected Windows builds and the patch.","search":"'-105499':18A,21A '-2026':17A,20A 'advanc':33B,64C 'advanced':23A 'allow':67C 'attack':47B,70C 'author':45B,69C 'bound':5A,43B,60C 'compon':38B 'cve':16A,19A 'elev':52B,72C 'flaw':29B 'gain':14A 'graphic':8A,37B 'infrastructur':26B 'let':10A 'local':12A,46B,74C 'machin':56B 'memori':40B 'out-of-bound':2A,57C 'outsid':41B 'platform':9A,25A,35B,66C 'privileg':15A,53B,73C 'raster':34B,65C 'rasterization':24A 'read':6A,39B,61C 'use':49B 'user':13A 'window':1A,27B,32B,63C 'windows':22A","nicknames":[],"mitigations":[],"who_affected":"Windows machines where a user already has a local account can be affected by this local privilege escalation. The sources do not say which Windows builds are affected, and the NVD entry does not list fixed versions. Systems where only trusted administrators log in carry less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["advancedrasterizationplatform","windowsadvancedrasterizationplatform"],"ptokens":["advanced","platform","rasterization","windows"],"labels":["high","infrastructure","vendor","windows"],"campaign_type":null,"search_a":"'-105499':18A,21A '-2026':17A,20A 'advanced':23A 'bound':5A 'cve':16A,19A 'gain':14A 'graphic':8A 'let':10A 'local':12A 'out-of-bound':2A 'platform':9A,25A 'privileg':15A 'rasterization':24A 'read':6A 'user':13A 'window':1A 'windows':22A","search_b":"'advanc':33B 'attack':47B 'author':45B 'bound':43B 'compon':38B 'elev':52B 'flaw':29B 'graphic':37B 'infrastructur':26B 'local':46B 'machin':56B 'memori':40B 'outsid':41B 'platform':35B 'privileg':53B 'raster':34B 'read':39B 'use':49B 'window':27B,32B","search_c":"'advanc':64C 'allow':67C 'attack':70C 'author':69C 'bound':60C 'elev':72C 'local':74C 'out-of-bound':57C 'platform':66C 'privileg':73C 'raster':65C 'read':61C 'window':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105499","severity":null,"published_at":"2026-11-10T19:17:48+00:00","modified_at":"2026-11-10T19:17:48+00:00","first_seen_at":"2026-11-10T19:24:14+00:00","fetched_at":"2026-11-10T19:24:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}