{"id":"CVE-2026-108407","kind":"vulnerability","aliases":["CVE-2026-108407"],"related":[],"title":"Windows GDI: out-of-bounds read lets a local user gain higher privileges","description":"Out-of-bounds read in Windows GDI allows an authorized attacker to elevate privileges locally.","summary":"A flaw in the Windows GDI graphics component lets an authorized local user read memory outside a buffer and elevate their privileges. An attacker needs a valid account on the machine first.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"- Check the Windows build with `winver` and compare it against the fixed build in Microsoft's security update guide for CVE-2026-108407 (unknown from the sources)\n- Confirm Windows Update history shows the latest cumulative update installed","fix":null,"status":"open","published_at":"2026-11-10T19:18:09+00:00","first_seen_at":"2026-11-10T19:24:22+00:00","triaged_at":"2026-11-10T19:42:27+00:00","updated_at":"2026-11-10T19:42:27+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:42:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows GDI: out-of-bounds read lets a local user gain higher privileges","impact":"high","summary":"A flaw in the Windows GDI graphics component lets an authorized local user read memory outside a buffer and elevate their privileges. An attacker needs a valid account on the machine first.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM privileges on the machine","analyst_note":"Find the affected Windows builds and the Microsoft patch for CVE-2026-108407 in the Microsoft Security Update Guide; the NVD entry gives no version ranges.","how_to_check":"- Check the Windows build with `winver` and compare it against the fixed build in Microsoft's security update guide for CVE-2026-108407 (unknown from the sources)\n- Confirm Windows Update history shows the latest cumulative update installed","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Any Windows system with GDI present is in scope, since GDI is part of the core Windows graphics stack. Exposure needs a user with a local account who can already run code on the machine; machines where only trusted administrators log on carry less risk. The sources do not name affected Windows builds or the fixed update.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000715,"input_tokens":4484,"output_tokens":534,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and the Microsoft patch for CVE-2026-108407 in the Microsoft Security Update Guide; the NVD entry gives no version ranges.","search":"'-108407':17A,20A '-2026':16A,19A 'account':50B 'allow':63C 'attack':46B,66C 'author':33B,65C 'bound':6A,58C 'buffer':40B 'compon':30B 'cve':15A,18A 'elev':42B,68C 'first':54B 'flaw':24B 'gain':12A 'gdi':2A,28B,62C 'graphic':29B 'higher':13A 'infrastructur':21B 'let':8A,31B 'local':10A,34B,70C 'machin':53B 'memori':37B 'need':47B 'out-of-bound':3A,55C 'outsid':38B 'privileg':14A,44B,69C 'read':7A,36B,59C 'user':11A,35B 'valid':49B 'window':1A,22B,27B,61C","nicknames":[],"mitigations":[],"who_affected":"Any Windows system with GDI present is in scope, since GDI is part of the core Windows graphics stack. Exposure needs a user with a local account who can already run code on the machine; machines where only trusted administrators log on carry less risk. The sources do not name affected Windows builds or the fixed update.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows"],"campaign_type":null,"search_a":"'-108407':17A,20A '-2026':16A,19A 'bound':6A 'cve':15A,18A 'gain':12A 'gdi':2A 'higher':13A 'let':8A 'local':10A 'out-of-bound':3A 'privileg':14A 'read':7A 'user':11A 'window':1A","search_b":"'account':50B 'attack':46B 'author':33B 'buffer':40B 'compon':30B 'elev':42B 'first':54B 'flaw':24B 'gdi':28B 'graphic':29B 'infrastructur':21B 'let':31B 'local':34B 'machin':53B 'memori':37B 'need':47B 'outsid':38B 'privileg':44B 'read':36B 'user':35B 'valid':49B 'window':22B,27B","search_c":"'allow':63C 'attack':66C 'author':65C 'bound':58C 'elev':68C 'gdi':62C 'local':70C 'out-of-bound':55C 'privileg':69C 'read':59C 'window':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108407","severity":null,"published_at":"2026-11-10T19:18:09+00:00","modified_at":"2026-11-10T19:18:10+00:00","first_seen_at":"2026-11-10T19:24:22+00:00","fetched_at":"2026-11-10T19:24:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}