---
id: "CVE-2026-118280"
page: "https://infrastack.ai/live/CVE-2026-118280"
kind: "vulnerability"
aliases: ["CVE-2026-118280"]
title: "Windows: heap overflow in graphics platform lets local users gain privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "local-privilege-escalation", "windows"]
not_affected_if: ["no-local-users"]
published_at: "2026-11-10T19:19:41+00:00"
first_seen_at: "2026-11-10T19:24:51+00:00"
updated_at: "2026-11-10T23:15:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118280", "first_seen_at": "2026-11-10T19:24:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T23:15:56+00:00"}]
exploit_sources: []
---

# Windows: heap overflow in graphics platform lets local users gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-118280 (this .md is for agents)

A heap-based buffer overflow in the Windows Advanced Rasterization Platform, the Windows graphics component, can be triggered by an authorized local user. An attacker who already has a local account can use it to elevate privileges on the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T19:24:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118280
- 2026-11-10T23:15:56+00:00 analyst — Could not read the MSRC entry: it is JavaScript-only, WebFetch and web-cli returned empty pages, and browser-cli is out of credits (402). The NVD page was also empty. No builds, KB numbers or fix could be confirmed, nothing marked verified. To settle it, read the MSRC Security Update Guide entry for CVE-2026-118280 (affected builds and KB articles) once the browser or the MSRC CVRF API is reachable. X and search were not used.

## From the sources

Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_