{"id":"CVE-2026-118227","kind":"vulnerability","aliases":["CVE-2026-118227"],"related":[],"title":"Windows graphics platform overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Advanced Rasterization Platform lets an authorized attacker on the machine raise their privileges. The attacker needs an account on the affected system first.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","patch-tuesday","windows"],"not_affected_if":["no-local-users"],"how_to_check":"Check that the November 2026 Patch Tuesday cumulative update (released 2026-11-10) is installed: run 'Get-HotFix' in PowerShell or look at Settings > Windows Update > Update history. Match the KB for your Windows version against Microsoft's advisory for CVE-2026-118227 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118227 (exact KB numbers not confirmed here).","fix":"Install the November 2026 Windows cumulative update for your Windows version (Microsoft Patch Tuesday, 2026-11-10); exact KB per build not confirmed from the MSRC page.","status":"open","published_at":"2026-11-10T19:19:40+00:00","first_seen_at":"2026-11-10T19:24:51+00:00","triaged_at":"2026-11-10T19:30:06+00:00","updated_at":"2026-11-10T23:18:02+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:30:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows graphics platform overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Advanced Rasterization Platform lets an authorized attacker on the machine raise their privileges. The attacker needs an account on the affected system first.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on Windows","analyst_note":"Find the affected Windows builds and Microsoft's patch from the NVD entry or the Microsoft Security Response Center advisory for CVE-2026-118227.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Windows systems where users have local accounts, such as shared servers, workstations and virtual desktops. The sources do not name affected Windows builds or a patch. Systems where only trusted administrators log in are at lower risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000663,"input_tokens":4502,"output_tokens":425,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and Microsoft's patch from the NVD entry or the Microsoft Security Response Center advisory for CVE-2026-118227.","search":"'-118227':14A,17A '-2026':13A,16A 'account':53B 'advanc':36B,66C 'affect':56B 'allow':69C 'attack':42B,50B,72C 'author':41B,71C 'base':30B,61C 'buffer':31B,62C 'cve':12A,15A 'elev':74C 'escal':22B 'first':58B 'gain':9A 'graphic':2A 'heap':29B,60C 'heap-bas':28B,59C 'higher':10A 'infrastructur':18B 'let':5A,39B 'local':7A,20B,76C 'local-privilege-escal':19B 'machin':45B 'need':51B 'overflow':4A,32B,63C 'patch':24B 'patch-tuesday':23B 'platform':3A,38B,68C 'privileg':11A,21B,48B,75C 'rais':46B 'raster':37B,67C 'system':57B 'tuesday':25B 'user':8A 'window':1A,26B,35B,65C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where people other than administrators can sign in or run code, such as shared servers, workstations and virtual desktops. An aggregator lists Windows 10 version 1809 first among affected products; the full list of builds comes from Microsoft's advisory, which I could not read. Systems where only trusted administrators log in are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","patchtuesday","windows"],"campaign_type":null,"search_a":"'-118227':14A,17A '-2026':13A,16A 'cve':12A,15A 'gain':9A 'graphic':2A 'higher':10A 'let':5A 'local':7A 'overflow':4A 'platform':3A 'privileg':11A 'user':8A 'window':1A","search_b":"'account':53B 'advanc':36B 'affect':56B 'attack':42B,50B 'author':41B 'base':30B 'buffer':31B 'escal':22B 'first':58B 'heap':29B 'heap-bas':28B 'infrastructur':18B 'let':39B 'local':20B 'local-privilege-escal':19B 'machin':45B 'need':51B 'overflow':32B 'patch':24B 'patch-tuesday':23B 'platform':38B 'privileg':21B,48B 'rais':46B 'raster':37B 'system':57B 'tuesday':25B 'window':26B,35B","search_c":"'advanc':66C 'allow':69C 'attack':72C 'author':71C 'base':61C 'buffer':62C 'elev':74C 'heap':60C 'heap-bas':59C 'local':76C 'overflow':63C 'platform':68C 'privileg':75C 'raster':67C 'window':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118227","severity":null,"published_at":"2026-11-10T19:19:40+00:00","modified_at":"2026-11-10T19:19:40+00:00","first_seen_at":"2026-11-10T19:24:51+00:00","fetched_at":"2026-11-10T19:24:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118227:3137","url":null,"severity":null,"published_at":"2026-11-10T23:18:02+00:00","modified_at":"2026-11-10T23:18:02+00:00","first_seen_at":"2026-11-10T23:18:02+00:00","fetched_at":"2026-11-10T23:18:02+00:00","note":"MSRC page unreadable via tools (JS-only); NVD page empty. Aggregators (VulnFeed, Feedly) list it as patched in the 2026-11-10 Patch Tuesday, first listed product Windows 10 1809; exact builds/KBs not read from primary source. Nothing verified."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}