{"id":"CVE-2026-118223","kind":"vulnerability","aliases":["CVE-2026-118223"],"related":[],"title":"Windows: use-after-free in graphics platform lets local users gain privileges","description":"Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.","summary":"A memory-handling bug in the Windows Advanced Rasterization Platform, a graphics component, can be abused by a logged-in local user to raise their privileges. The sources give no further detail on exploitation.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","warp","windows"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":"Run winver (or PowerShell Get-ComputerInfo) to get the Windows build. Compare it with the November 2026 cumulative update that Microsoft lists for CVE-2026-118223 in the Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118223). Windows Update with the November 10, 2026 patches installed should cover it, but the exact KB per Windows version is not confirmed here.","fix":"unknown: Install the November 2026 Patch Tuesday cumulative update for your Windows version. The KB and build numbers are not confirmed from the MSRC page.","status":"open","published_at":"2026-11-10T19:19:39+00:00","first_seen_at":"2026-11-10T19:24:50+00:00","triaged_at":"2026-11-10T19:40:38+00:00","updated_at":"2026-11-10T23:19:09+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:40:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: use-after-free in graphics platform lets local users gain privileges","impact":"high","summary":"A memory-handling bug in the Windows Advanced Rasterization Platform, a graphics component, can be abused by a logged-in local user to raise their privileges. The sources give no further detail on exploitation.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the affected Windows builds and the Microsoft update for CVE-2026-118223 in the MSRC advisory; the NVD entry gives no product ranges.","how_to_check":"- Check the Windows build with `winver` and compare it against the update listed for CVE-2026-118223 in Microsoft's security guide\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Affects Windows systems where an attacker already has a local account on the machine, such as shared workstations, terminal servers, or hosts where untrusted users run code. The sources do not list affected Windows builds. Machines without untrusted local users are at lower risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4492,"output_tokens":496,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and the Microsoft update for CVE-2026-118223 in the MSRC advisory; the NVD entry gives no product ranges.","search":"'-118223':16A,19A '-2026':15A,18A 'abus':43B 'advanc':35B,68C 'allow':71C 'attack':74C 'author':73C 'bug':31B 'compon':40B 'cve':14A,17A 'detail':60B 'elev':76C 'escal':24B 'exploit':62B 'free':5A,65C 'gain':12A 'give':57B 'graphic':7A,39B 'handl':30B 'infrastructur':20B 'let':9A 'local':10A,22B,49B,78C 'local-privilege-escal':21B 'log':47B 'logged-in':46B 'memori':29B 'memory-handl':28B 'platform':8A,37B,70C 'privileg':13A,23B,54B,77C 'rais':52B 'raster':36B,69C 'sourc':56B 'use':3A,63C 'use-after-fre':2A 'user':11A,50B 'warp':25B 'window':1A,26B,34B,67C","nicknames":[],"mitigations":[],"who_affected":"Affects Windows systems where an attacker already has a local account on the machine, such as shared workstations, terminal servers, or hosts where untrusted users run code. The sources do not list affected Windows builds. Machines without untrusted local users are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","warp","windows"],"campaign_type":null,"search_a":"'-118223':16A,19A '-2026':15A,18A 'cve':14A,17A 'free':5A 'gain':12A 'graphic':7A 'let':9A 'local':10A 'platform':8A 'privileg':13A 'use':3A 'use-after-fre':2A 'user':11A 'window':1A","search_b":"'abus':43B 'advanc':35B 'bug':31B 'compon':40B 'detail':60B 'escal':24B 'exploit':62B 'give':57B 'graphic':39B 'handl':30B 'infrastructur':20B 'local':22B,49B 'local-privilege-escal':21B 'log':47B 'logged-in':46B 'memori':29B 'memory-handl':28B 'platform':37B 'privileg':23B,54B 'rais':52B 'raster':36B 'sourc':56B 'user':50B 'warp':25B 'window':26B,34B","search_c":"'advanc':68C 'allow':71C 'attack':74C 'author':73C 'elev':76C 'free':65C 'local':78C 'platform':70C 'privileg':77C 'raster':69C 'use':63C 'window':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118223","severity":null,"published_at":"2026-11-10T19:19:39+00:00","modified_at":"2026-11-10T19:19:40+00:00","first_seen_at":"2026-11-10T19:24:50+00:00","fetched_at":"2026-11-10T19:24:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118223:3142","url":null,"severity":null,"published_at":"2026-11-10T23:19:09+00:00","modified_at":"2026-11-10T23:19:09+00:00","first_seen_at":"2026-11-10T23:19:09+00:00","fetched_at":"2026-11-10T23:19:09+00:00","note":"MSRC page is JS-only and the CVRF API and browser were unreachable, so no primary source was read. Rapid7 and NVD only repeat the description and CVSS 7.8 (AV:L/AC:H/PR:L). No builds or KB numbers found; nothing verified. Revisit when MSRC data is readable."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}