{"id":"CVE-2026-118224","kind":"vulnerability","aliases":["CVE-2026-118224"],"related":[],"title":"Windows: use-after-free in graphics rasterizer lets local users gain admin rights","description":"Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in the Windows Advanced Rasterization Platform, the graphics component that draws on-screen content, lets an already-authorized local user escalate privileges. An attacker who can already run code on the machine can gain higher system privileges.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":"- Check the Windows build and update level under Settings > System > About, or run `winver`, and compare against Microsoft's security update for CVE-2026-118224 (unknown from the sources given)\n- Confirm the machine is on a supported, patched Windows release via Windows Update history","fix":null,"status":"open","published_at":"2026-11-10T19:19:40+00:00","first_seen_at":"2026-11-10T19:24:50+00:00","triaged_at":"2026-11-10T19:40:38+00:00","updated_at":"2026-11-10T23:18:54+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:40:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: use-after-free in graphics rasterizer lets local users gain admin rights","impact":"high","summary":"A use-after-free bug in the Windows Advanced Rasterization Platform, the graphics component that draws on-screen content, lets an already-authorized local user escalate privileges. An attacker who can already run code on the machine can gain higher system privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-118224 to confirm affected Windows builds and the patch.","how_to_check":"- Check the Windows build and update level under Settings > System > About, or run `winver`, and compare against Microsoft's security update for CVE-2026-118224 (unknown from the sources given)\n- Confirm the machine is on a supported, patched Windows release via Windows Update history","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Any Windows machine where a user already has a local account or can run code can be exposed, so shared workstations, terminal servers and multi-user systems matter most. The sources do not name the affected Windows builds, and they do not say whether a fix is available. Single-user machines with no untrusted local code are lower risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000729,"input_tokens":4492,"output_tokens":560,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-118224 to confirm affected Windows builds and the patch.","search":"'-118224':17A,20A '-2026':16A,19A 'admin':13A 'advanc':32B,73C 'allow':76C 'alreadi':47B,57B 'already-author':46B 'attack':54B,79C 'author':48B,78C 'bug':28B 'code':59B 'compon':37B 'content':43B 'cve':15A,18A 'draw':39B 'elev':81C 'escal':51B 'free':5A,27B,70C 'gain':12A,64B 'graphic':7A,36B 'higher':65B 'infrastructur':21B 'let':9A,44B 'local':10A,49B,83C 'machin':62B 'on-screen':40B 'platform':34B,75C 'privileg':52B,67B,82C 'raster':8A,33B,74C 'right':14A 'run':58B 'screen':42B 'system':66B 'use':3A,25B,68C 'use-after-fre':2A,24B 'user':11A,50B 'window':1A,22B,31B,72C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine where a user already has a local account or can run code can be exposed, so shared workstations, terminal servers and multi-user systems matter most. The affected Windows builds are not yet confirmed from Microsoft's own page. Microsoft appears to have listed this CVE in its November 2026 security updates, so install that month's Windows update. Single-user machines with no untrusted local code are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows"],"campaign_type":null,"search_a":"'-118224':17A,20A '-2026':16A,19A 'admin':13A 'cve':15A,18A 'free':5A 'gain':12A 'graphic':7A 'let':9A 'local':10A 'raster':8A 'right':14A 'use':3A 'use-after-fre':2A 'user':11A 'window':1A","search_b":"'advanc':32B 'alreadi':47B,57B 'already-author':46B 'attack':54B 'author':48B 'bug':28B 'code':59B 'compon':37B 'content':43B 'draw':39B 'escal':51B 'free':27B 'gain':64B 'graphic':36B 'higher':65B 'infrastructur':21B 'let':44B 'local':49B 'machin':62B 'on-screen':40B 'platform':34B 'privileg':52B,67B 'raster':33B 'run':58B 'screen':42B 'system':66B 'use':25B 'use-after-fre':24B 'user':50B 'window':22B,31B","search_c":"'advanc':73C 'allow':76C 'attack':79C 'author':78C 'elev':81C 'free':70C 'local':83C 'platform':75C 'privileg':82C 'raster':74C 'use':68C 'window':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118224","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118224","severity":null,"published_at":"2026-11-10T19:19:40+00:00","modified_at":"2026-11-10T19:19:40+00:00","first_seen_at":"2026-11-10T19:24:50+00:00","fetched_at":"2026-11-10T19:24:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118224:3141","url":null,"severity":null,"published_at":"2026-11-10T23:18:54+00:00","modified_at":"2026-11-10T23:18:54+00:00","first_seen_at":"2026-11-10T23:18:54+00:00","fetched_at":"2026-11-10T23:18:54+00:00","note":"Could not read Microsoft's entry: the MSRC page needs JavaScript and the browser had no credits. The CVRF API only showed the November 2026 Security Updates release (2026-Nov, 10 Nov 2026), and the full CVRF file is over 10 MB. Affected builds, KB numbers and the fixed build are still unknown. Nothing is verified and no documents are linked. To settle it, open the MSRC Update Guide entry for CVE-2026-118224 in a browser. Exploitation and PoC status were not checked. The X and Exa searches were not run."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}