{"id":"CVE-2026-118225","kind":"vulnerability","aliases":["CVE-2026-118225"],"related":[],"title":"Windows Advanced Rasterization Platform: local attacker can gain elevated privileges","description":"Inclusion of functionality from untrusted control sphere in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.","summary":"Windows Advanced Rasterization Platform (WARP) loads functionality from an untrusted control sphere (CWE-829). A low-privileged local user can use it to elevate privileges (CVSS 8.8, AV:L/PR:L/UI:N/S:C). No exploitation reported.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Advanced Rasterization Platform","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 10 / Server 2019 (1809)","fixed":["10.0.17763.9376"],"affected":"10.0.17763.0 - < 10.0.17763.9376","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7807"],"affected":"< 10.0.19044.7807","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7807"],"affected":"< 10.0.19045.7807","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7652"],"affected":"< 10.0.22631.7652","ecosystem":"vendor"},{"name":"Windows 11 24H2 / 25H2 / 26H2","fixed":["10.0.26100.9711","10.0.26200.9711","10.0.26300.9711"],"affected":"< 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.26300.9711 (26H2)","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3231"],"affected":"< 10.0.28000.3231","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5761"],"affected":"< 10.0.20348.5761","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33650"],"affected":"< 10.0.26100.33650","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local-privilege-escalation","warp","windows"],"not_affected_if":["patched-build"],"how_to_check":"Run winver or [System.Environment]::OSVersion.Version in PowerShell and compare the build number (e.g. 10.0.19045.xxxx) to the fixed build for your Windows version. Anything lower is affected. WARP ships by default in Windows, so no setting decides exposure.","fix":"Install the November 2026 Windows cumulative update: Win10 1809/Server 2019 10.0.17763.9376, Win10 21H2 10.0.19044.7807, Win10 22H2 10.0.19045.7807, Win11 23H2 10.0.22631.7652, Win11 24H2 10.0.26100.9711, Win11 25H2 10.0.26200.9711, Win11 26H1 10.0.28000.3231, Win11 26H2 10.0.26300.9711, Server 2022 10.0.20348.5761, Server 2025 10.0.26100.33650.","status":"open","published_at":"2026-11-10T19:19:40+00:00","first_seen_at":"2026-11-10T19:24:50+00:00","triaged_at":"2026-11-10T19:30:07+00:00","updated_at":"2026-11-10T23:17:53+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:30:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Advanced Rasterization Platform: local attacker can gain elevated privileges","impact":"high","summary":"Windows Advanced Rasterization Platform includes functionality from an untrusted control sphere, which an authorized local user can abuse. The attacker gains elevated privileges on the affected machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows machine","analyst_note":"Confirm affected Windows builds and the Microsoft advisory for the patch; sources give only the NVD description.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Advanced Rasterization Platform","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00064,"input_tokens":4506,"output_tokens":378,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Windows builds and the Microsoft advisory for the patch; sources give only the NVD description.","search":"'-118225':13A,16A '-2026':12A,15A '-829':69B '10':22A,27A,30A '11':33A,36A,41A '1809':25A '2019':24A '2022':45A '2025':48A '21h2':28A '22h2':31A '23h2':34A '24h2':37A '25h2':38A '26h1':42A '26h2':39A '8.8':83B 'advanc':2A,57B,101C 'advanced':18A 'allow':104C 'attack':6A,107C 'author':106C 'av':84B 'c':88B 'control':66B,97C 'cve':11A,14A 'cvss':82B 'cwe':68B 'elev':9A,80B,109C 'escal':53B 'exploit':90B 'function':62B,94C 'gain':8A 'inclus':92C 'infrastructur':49B 'l/pr':85B 'l/ui':86B 'load':61B 'local':5A,51B,74B,111C 'local-privilege-escal':50B 'low':72B 'low-privileg':71B 'n/s':87B 'platform':4A,20A,59B,103C 'privileg':10A,52B,73B,81B,110C 'raster':3A,58B,102C 'rasterization':19A 'report':91B 'server':23A,44A,47A 'sphere':67B,98C 'untrust':65B,96C 'use':77B 'user':75B 'warp':54B,60B 'window':1A,55B,56B,100C 'windows':17A,21A,26A,29A,32A,35A,40A,43A,46A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["1021h2","1022h2","10server20191809","1123h2","1124h225h226h2","1126h1","advancedrasterizationplatform","server2022","server2025","windows1021h2","windows1022h2","windows10server20191809","windows1123h2","windows1124h225h226h2","windows1126h1","windowsadvancedrasterizationplatform","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1809","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","advanced","platform","rasterization","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","vendor","warp","windows"],"campaign_type":null,"search_a":"'-118225':13A,16A '-2026':12A,15A '10':22A,27A,30A '11':33A,36A,41A '1809':25A '2019':24A '2022':45A '2025':48A '21h2':28A '22h2':31A '23h2':34A '24h2':37A '25h2':38A '26h1':42A '26h2':39A 'advanc':2A 'advanced':18A 'attack':6A 'cve':11A,14A 'elev':9A 'gain':8A 'local':5A 'platform':4A,20A 'privileg':10A 'raster':3A 'rasterization':19A 'server':23A,44A,47A 'window':1A 'windows':17A,21A,26A,29A,32A,35A,40A,43A,46A","search_b":"'-829':69B '8.8':83B 'advanc':57B 'av':84B 'c':88B 'control':66B 'cvss':82B 'cwe':68B 'elev':80B 'escal':53B 'exploit':90B 'function':62B 'infrastructur':49B 'l/pr':85B 'l/ui':86B 'load':61B 'local':51B,74B 'local-privilege-escal':50B 'low':72B 'low-privileg':71B 'n/s':87B 'platform':59B 'privileg':52B,73B,81B 'raster':58B 'report':91B 'sphere':67B 'untrust':65B 'use':77B 'user':75B 'warp':54B,60B 'window':55B,56B","search_c":"'advanc':101C 'allow':104C 'attack':107C 'author':106C 'control':97C 'elev':109C 'function':94C 'inclus':92C 'local':111C 'platform':103C 'privileg':110C 'raster':102C 'sphere':98C 'untrust':96C 'window':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118225","severity":null,"published_at":"2026-11-10T19:19:40+00:00","modified_at":"2026-11-10T19:19:40+00:00","first_seen_at":"2026-11-10T19:24:50+00:00","fetched_at":"2026-11-10T19:24:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118225:3139","url":"https://nvd.nist.gov/vuln/detail/cve-2026-118225","severity":null,"published_at":"2026-11-10T23:17:53+00:00","modified_at":"2026-11-10T23:17:53+00:00","first_seen_at":"2026-11-10T23:17:53+00:00","fetched_at":"2026-11-10T23:17:53+00:00","note":"MSRC page is JS-only and not readable; builds and fixed versions taken from Microsoft CNA data in NVD. Nothing marked verified. No exploitation or PoC found.","cites":["https://nvd.nist.gov/vuln/detail/cve-2026-118225"]}],"documents":[{"id":120099,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-118225","title":"NVD CVE-2026-118225 (Microsoft CNA affected builds)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}