{"id":"CVE-2026-118279","kind":"vulnerability","aliases":["CVE-2026-118279"],"related":[],"title":"Windows graphics platform heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Advanced Rasterization Platform, the Windows graphics component, lets an authorized attacker raise their privileges on the same machine. Nothing in the sources says it is exploited in the wild.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows"],"not_affected_if":["auth-required"],"how_to_check":"Unknown until the MSRC Security Update Guide entry for CVE-2026-118279 lists affected Windows builds and KB. Meanwhile check that Windows Update on each machine is current with the November 2026 cumulative update.","fix":null,"status":"open","published_at":"2026-11-10T19:19:41+00:00","first_seen_at":"2026-11-10T19:24:51+00:00","triaged_at":"2026-11-10T19:30:00+00:00","updated_at":"2026-11-10T23:15:56+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:30:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows graphics platform heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Advanced Rasterization Platform, the Windows graphics component, lets an authorized attacker raise their privileges on the same machine. Nothing in the sources says it is exploited in the wild.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-118279 to get affected Windows builds and the patch.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Any Windows machine that runs the affected Windows build is exposed, and the attacker needs a local account first. The sources do not name the affected Windows versions or a patch, so unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000658,"input_tokens":4502,"output_tokens":416,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-118279 to get affected Windows builds and the patch.","search":"'-118279':15A,18A '-2026':14A,17A 'advanc':34B,70C 'allow':73C 'attack':44B,76C 'author':43B,75C 'base':28B,65C 'buffer':29B,66C 'compon':40B 'cve':13A,16A 'elev':78C 'escal':23B 'exploit':59B 'gain':10A 'graphic':2A,39B 'heap':4A,27B,64C 'heap-bas':26B,63C 'higher':11A 'infrastructur':19B 'let':6A,41B 'local':8A,21B,80C 'local-privilege-escal':20B 'machin':51B 'noth':52B 'overflow':5A,30B,67C 'platform':3A,36B,72C 'privileg':12A,22B,47B,79C 'rais':45B 'raster':35B,71C 'say':56B 'sourc':55B 'user':9A 'wild':62B 'window':1A,24B,33B,38B,69C","nicknames":[],"mitigations":[],"who_affected":"Windows machines running a build affected by this Windows Advanced Rasterization Platform (WARP) flaw; the attacker needs a local account first. Affected builds and the patch are not yet confirmed from Microsoft's page, so check the MSRC entry. Servers that only run trusted admin code are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","localprivilegeescalation","windows"],"campaign_type":null,"search_a":"'-118279':15A,18A '-2026':14A,17A 'cve':13A,16A 'gain':10A 'graphic':2A 'heap':4A 'higher':11A 'let':6A 'local':8A 'overflow':5A 'platform':3A 'privileg':12A 'user':9A 'window':1A","search_b":"'advanc':34B 'attack':44B 'author':43B 'base':28B 'buffer':29B 'compon':40B 'escal':23B 'exploit':59B 'graphic':39B 'heap':27B 'heap-bas':26B 'infrastructur':19B 'let':41B 'local':21B 'local-privilege-escal':20B 'machin':51B 'noth':52B 'overflow':30B 'platform':36B 'privileg':22B,47B 'rais':45B 'raster':35B 'say':56B 'sourc':55B 'wild':62B 'window':24B,33B,38B","search_c":"'advanc':70C 'allow':73C 'attack':76C 'author':75C 'base':65C 'buffer':66C 'elev':78C 'heap':64C 'heap-bas':63C 'local':80C 'overflow':67C 'platform':72C 'privileg':79C 'raster':71C 'window':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118279","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118279","severity":null,"published_at":"2026-11-10T19:19:41+00:00","modified_at":"2026-11-10T19:19:41+00:00","first_seen_at":"2026-11-10T19:24:51+00:00","fetched_at":"2026-11-10T19:24:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118279:3131","url":null,"severity":null,"published_at":"2026-11-10T23:15:56+00:00","modified_at":"2026-11-10T23:15:56+00:00","first_seen_at":"2026-11-10T23:15:56+00:00","fetched_at":"2026-11-10T23:15:56+00:00","note":"Could not read MSRC entry (JS-only page returned only its title; browser-cli 402, NVD fetch empty). No affected builds or KB found; nothing verified. Fix left unknown. Revisit when MSRC/CVRF is readable."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}