{"id":"CVE-2026-125137","kind":"vulnerability","aliases":["CVE-2026-125137"],"related":[],"title":"Windows Graphics Kernel: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Graphics Kernel lets an attacker who already has a local account raise their privileges. The sources do not describe a remote path or exploitation in the wild.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Graphics Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","local-users","windows"],"not_affected_if":["no-local-logon"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:07+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","triaged_at":"2026-11-10T19:38:50+00:00","updated_at":"2026-11-10T19:38:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Graphics Kernel: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Graphics Kernel lets an attacker who already has a local account raise their privileges. The sources do not describe a remote path or exploitation in the wild.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","local-users"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-125137 to confirm affected Windows builds and the patch release.","how_to_check":"unknown","plain_action":"","product_name":"Windows Graphics Kernel","needs_analyst":true,"not_affected_if":["no-local-logon"],"who_is_affected":"Windows machines that let users log on locally are the systems to look at, since the attacker must already be authorized on the device. The sources do not name affected Windows builds or say whether a default configuration is exposed.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000679,"input_tokens":4498,"output_tokens":458,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-125137 to confirm affected Windows builds and the patch release.","search":"'-125137':15A,18A '-2026':14A,17A 'account':46B 'allow':72C 'alreadi':42B 'attack':40B,75C 'author':74C 'base':30B,65C 'buffer':31B,66C 'cve':13A,16A 'describ':54B 'elev':77C 'exploit':59B 'gain':10A 'graphic':2A,36B,70C 'graphics':20A 'heap':4A,29B,64C 'heap-bas':28B,63C 'higher':11A 'infrastructur':22B 'kernel':3A,21A,37B,71C 'let':6A,38B 'local':8A,24B,45B,79C 'local-us':23B 'overflow':5A,32B,67C 'path':57B 'privileg':12A,49B,78C 'rais':47B 'remot':56B 'sourc':51B 'user':9A,25B 'wild':62B 'window':1A,26B,35B,69C 'windows':19A","nicknames":[],"mitigations":[],"who_affected":"Windows machines that let users log on locally are the systems to look at, since the attacker must already be authorized on the device. The sources do not name affected Windows builds or say whether a default configuration is exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["graphicskernel","windowsgraphicskernel"],"ptokens":["graphics","kernel","windows"],"labels":["high","infrastructure","localusers","vendor","windows"],"campaign_type":null,"search_a":"'-125137':15A,18A '-2026':14A,17A 'cve':13A,16A 'gain':10A 'graphic':2A 'graphics':20A 'heap':4A 'higher':11A 'kernel':3A,21A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'user':9A 'window':1A 'windows':19A","search_b":"'account':46B 'alreadi':42B 'attack':40B 'base':30B 'buffer':31B 'describ':54B 'exploit':59B 'graphic':36B 'heap':29B 'heap-bas':28B 'infrastructur':22B 'kernel':37B 'let':38B 'local':24B,45B 'local-us':23B 'overflow':32B 'path':57B 'privileg':49B 'rais':47B 'remot':56B 'sourc':51B 'user':25B 'wild':62B 'window':26B,35B","search_c":"'allow':72C 'attack':75C 'author':74C 'base':65C 'buffer':66C 'elev':77C 'graphic':70C 'heap':64C 'heap-bas':63C 'kernel':71C 'local':79C 'overflow':67C 'privileg':78C 'window':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125137","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125137","severity":null,"published_at":"2026-11-10T19:21:07+00:00","modified_at":"2026-11-10T19:21:07+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","fetched_at":"2026-11-10T19:25:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}