{"id":"CVE-2026-118228","kind":"vulnerability","aliases":["CVE-2026-118228"],"related":[],"title":"Windows: heap overflow in graphics platform lets local users gain admin rights","description":"Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Advanced Rasterization Platform, the graphics component of Windows, lets a logged-in user raise their privileges on the machine. The sources do not describe a remote path, so the attacker needs a local account first.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9376"],"affected":"< 10.0.17763.9376","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7807"],"affected":"< 10.0.19044.7807","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7807"],"affected":"< 10.0.19045.7807","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7652"],"affected":"< 10.0.22631.7652","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9711"],"affected":"< 10.0.26100.9711","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9711"],"affected":"< 10.0.26200.9711","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3231"],"affected":"< 10.0.28000.3231","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9711"],"affected":"< 10.0.26300.9711","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5761"],"affected":"< 10.0.20348.5761","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33650"],"affected":"< 10.0.26100.33650","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","local","privilege-escalation","windows"],"not_affected_if":["no-local-users","patched-november-2026"],"how_to_check":"Run 'winver' or PowerShell '[System.Environment]::OSVersion.Version' and compare the build with the fixed builds in the product list (e.g. Windows 11 24H2 needs 10.0.26100.9711 or later, Windows 10 22H2 10.0.19045.7807, Server 2022 10.0.20348.5761, Server 2025 10.0.26100.33650). Install the November 2026 cumulative update; KB number not confirmed, check the MSRC page.","fix":"Install the November 2026 Windows cumulative update that raises your build to at least the fixed build for your version (see products). KB number unconfirmed; see https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118228","status":"open","published_at":"2026-11-10T19:19:40+00:00","first_seen_at":"2026-11-10T19:24:51+00:00","triaged_at":"2026-11-10T19:30:04+00:00","updated_at":"2026-11-10T23:18:04+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:30:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: heap overflow in graphics platform lets local users gain admin rights","impact":"high","summary":"A heap-based buffer overflow in the Windows Advanced Rasterization Platform, the graphics component of Windows, lets a logged-in user raise their privileges on the machine. The sources do not describe a remote path, so the attacker needs a local account first.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local user gains SYSTEM privileges on the Windows machine.","analyst_note":"Find the Microsoft advisory for CVE-2026-118228 to get affected Windows builds, the patch KB and whether any user interaction is needed.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Any Windows machine where an untrusted or low-privilege user can log in or run code is in scope. Servers and workstations with only administrators logged in are less exposed. The sources do not state which Windows builds are affected or which update fixes it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4502,"output_tokens":456,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-118228 to get affected Windows builds, the patch KB and whether any user interaction is needed.","search":"'-118228':15A,18A '-2026':14A,17A '10':20A,25A,28A '11':31A,34A,37A,40A,43A '1809':21A '2019':23A '2022':47A '2025':50A '21h2':26A '22h2':29A '23h2':32A '24h2':35A '25h2':38A '26h1':41A '26h2':44A 'account':100B 'admin':11A 'advanc':66B,109C 'allow':112C 'attack':96B,115C 'author':114C 'base':60B,104C 'buffer':61B,105C 'compon':71B 'cve':13A,16A 'describ':90B 'elev':117C 'escal':55B 'first':101B 'gain':10A 'graphic':5A,70B 'heap':2A,59B,103C 'heap-bas':58B,102C 'infrastructur':51B 'let':7A,74B 'local':8A,52B,99B,119C 'log':77B 'logged-in':76B 'machin':85B 'need':97B 'overflow':3A,62B,106C 'path':93B 'platform':6A,68B,111C 'privileg':54B,82B,118C 'privilege-escal':53B 'rais':80B 'raster':67B,110C 'remot':92B 'right':12A 'server':22A,46A,49A 'sourc':87B 'user':9A,79B 'window':1A,56B,65B,73B,108C 'windows':19A,24A,27A,30A,33A,36A,39A,42A,45A,48A","nicknames":[],"mitigations":[],"who_affected":"Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2 to 26H2) and Windows Server 2019, 2022 and 2025 below the fixed builds. An attacker needs a local low-privilege account or code execution and no user interaction; no remote path is described. Machines where only trusted admins log in or run code are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1809","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","local","privilegeescalation","windows"],"campaign_type":null,"search_a":"'-118228':15A,18A '-2026':14A,17A '10':20A,25A,28A '11':31A,34A,37A,40A,43A '1809':21A '2019':23A '2022':47A '2025':50A '21h2':26A '22h2':29A '23h2':32A '24h2':35A '25h2':38A '26h1':41A '26h2':44A 'admin':11A 'cve':13A,16A 'gain':10A 'graphic':5A 'heap':2A 'let':7A 'local':8A 'overflow':3A 'platform':6A 'right':12A 'server':22A,46A,49A 'user':9A 'window':1A 'windows':19A,24A,27A,30A,33A,36A,39A,42A,45A,48A","search_b":"'account':100B 'advanc':66B 'attack':96B 'base':60B 'buffer':61B 'compon':71B 'describ':90B 'escal':55B 'first':101B 'graphic':70B 'heap':59B 'heap-bas':58B 'infrastructur':51B 'let':74B 'local':52B,99B 'log':77B 'logged-in':76B 'machin':85B 'need':97B 'overflow':62B 'path':93B 'platform':68B 'privileg':54B,82B 'privilege-escal':53B 'rais':80B 'raster':67B 'remot':92B 'sourc':87B 'user':79B 'window':56B,65B,73B","search_c":"'advanc':109C 'allow':112C 'attack':115C 'author':114C 'base':104C 'buffer':105C 'elev':117C 'heap':103C 'heap-bas':102C 'local':119C 'overflow':106C 'platform':111C 'privileg':118C 'raster':110C 'window':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118228","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118228","severity":null,"published_at":"2026-11-10T19:19:40+00:00","modified_at":"2026-11-10T19:19:40+00:00","first_seen_at":"2026-11-10T19:24:51+00:00","fetched_at":"2026-11-10T19:24:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118228:3136","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-118228","severity":null,"published_at":"2026-11-10T23:18:04+00:00","modified_at":"2026-11-10T23:18:04+00:00","first_seen_at":"2026-11-10T23:18:04+00:00","fetched_at":"2026-11-10T23:18:04+00:00","note":"NVD record carrying Microsoft's CNA affected data read; MSRC page not retrievable, so nothing marked verified and KB numbers unknown. Fixed builds taken from NVD list. Not exploited per CISA SSVC (exploitation none). No UI needed, local, low privilege.","cites":["https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-118228"]}],"documents":[{"id":120100,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-118228","title":"NVD record CVE-2026-118228 (Microsoft CNA affected data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}