{"id":"CVE-2026-94519","kind":"vulnerability","aliases":["CVE-2026-94519"],"related":[],"title":"Windows Graphics Kernel: use-after-free lets a local user gain privileges","description":"Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in the Windows Graphics Kernel lets an attacker who already has a local account raise their privileges. The sources do not say which Windows builds are affected or what fix Microsoft has shipped.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":">= 10.0.26100.0, < 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":">= 10.0.26200.0, < 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":">= 10.0.28000.0, < 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":">= 10.0.26300.0, < 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":">= 10.0.26100.0, < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","local","privilege-escalation","windows","windows-11","windows-server-2025"],"not_affected_if":["fully-patched-windows","no-local-logon"],"how_to_check":"Run winver or PowerShell [System.Environment]::OSVersion.Version / (Get-ComputerInfo).OsBuildNumber and compare the full build (e.g. 10.0.26100.xxxx) with the fixed builds: Win11 24H2 < 10.0.26100.9974, 25H2 < 10.0.26200.9974, 26H1 < 10.0.28000.3501, 26H2 < 10.0.26300.9974, Server 2025 (incl. Server Core) < 10.0.26100.33822 are vulnerable. Other Windows versions are not listed by Microsoft.","fix":"Install the November 2026 Windows cumulative update: Windows 11 24H2 build 10.0.26100.9974 or later, 25H2 10.0.26200.9974, 26H1 10.0.28000.3501, 26H2 10.0.26300.9974, Windows Server 2025 10.0.26100.33822. KB numbers not read.","status":"open","published_at":"2026-11-10T19:21:37+00:00","first_seen_at":"2026-11-10T19:25:21+00:00","triaged_at":"2026-11-10T19:49:58+00:00","updated_at":"2026-11-10T20:35:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-10T19:49:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Graphics Kernel: use-after-free lets a local user gain privileges","impact":"high","summary":"A use-after-free bug in the Windows Graphics Kernel lets an attacker who already has a local account raise their privileges. The sources do not say which Windows builds are affected or what fix Microsoft has shipped.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the affected Windows builds and the fixing update in the Microsoft Security Update Guide entry for CVE-2026-94519.","how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update guide entry for CVE-2026-94519.\n- Check whether the latest cumulative Windows update is installed (Settings > Windows Update).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-logon","fully-patched-windows"],"who_is_affected":"Only a user who already has an authorized local logon on the Windows machine can trigger this flaw, so it does not reach across the network by itself. Servers with many interactive or shared local accounts, and workstations where untrusted people log on, are the systems to look at first. The sources do not say which Windows versions are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4484,"output_tokens":535,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and the fixing update in the Microsoft Security Update Guide entry for CVE-2026-94519.","search":"'-11':42B '-2026':15A,18A '-94519':16A,19A '11':21A,24A,27A,30A '2025':34A,46B '24h2':22A '25h2':25A '26h1':28A '26h2':31A 'account':66B 'affect':79B 'allow':93C 'alreadi':62B 'attack':60B,96C 'author':95C 'bug':52B 'build':77B 'cve':14A,17A 'elev':98C 'escal':39B 'fix':82B 'free':7A,51B,88C 'gain':12A 'graphic':2A,56B,91C 'infrastructur':35B 'kernel':3A,57B,92C 'let':8A,58B 'local':10A,36B,65B,100C 'microsoft':83B 'privileg':13A,38B,69B,99C 'privilege-escal':37B 'rais':67B 'say':74B 'server':33A,45B 'ship':85B 'sourc':71B 'use':5A,49B,86C 'use-after-fre':4A,48B 'user':11A 'window':1A,40B,41B,44B,55B,76B,90C 'windows':20A,23A,26A,29A,32A 'windows-serv':43B","nicknames":[],"mitigations":[],"who_affected":"Windows 11 24H2, 25H2, 26H1 and 26H2 and Windows Server 2025 (including Server Core) below the November 2026 builds are affected. An attacker needs an existing local logon and has to win a race condition; success gives SYSTEM. Shared machines, terminal/RDP servers and workstations where untrusted people log on matter most; single-user machines with no untrusted code are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1124h2","1125h2","1126h1","1126h2","server2025","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2025"],"ptokens":["11","2025","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","local","privilegeescalation","windows","windows11","windowsserver2025"],"campaign_type":null,"search_a":"'-2026':15A,18A '-94519':16A,19A '11':21A,24A,27A,30A '2025':34A '24h2':22A '25h2':25A '26h1':28A '26h2':31A 'cve':14A,17A 'free':7A 'gain':12A 'graphic':2A 'kernel':3A 'let':8A 'local':10A 'privileg':13A 'server':33A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A 'windows':20A,23A,26A,29A,32A","search_b":"'-11':42B '2025':46B 'account':66B 'affect':79B 'alreadi':62B 'attack':60B 'bug':52B 'build':77B 'escal':39B 'fix':82B 'free':51B 'graphic':56B 'infrastructur':35B 'kernel':57B 'let':58B 'local':36B,65B 'microsoft':83B 'privileg':38B,69B 'privilege-escal':37B 'rais':67B 'say':74B 'server':45B 'ship':85B 'sourc':71B 'use':49B 'use-after-fre':48B 'window':40B,41B,44B,55B,76B 'windows-serv':43B","search_c":"'allow':93C 'attack':96C 'author':95C 'elev':98C 'free':88C 'graphic':91C 'kernel':92C 'local':100C 'privileg':99C 'use':86C 'window':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94519","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94519","severity":null,"published_at":"2026-11-10T19:21:37+00:00","modified_at":"2026-11-10T19:21:37+00:00","first_seen_at":"2026-11-10T19:25:21+00:00","fetched_at":"2026-11-10T19:25:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-94519:2680","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-94519","severity":null,"published_at":"2026-11-10T20:35:51+00:00","modified_at":"2026-11-10T20:35:51+00:00","first_seen_at":"2026-11-10T20:35:51+00:00","fetched_at":"2026-11-10T20:35:51+00:00","note":"MSRC API entry: Important EoP to SYSTEM, race needed, not exploited, not public, Exploitation Less Likely. Build ranges from Microsoft CNA data via NVD; MSRC page is JS-only so nothing marked verified; KB numbers not found.","cites":["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-94519","https://nvd.nist.gov/vuln/detail/CVE-2026-94519"]}],"documents":[{"id":118048,"url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-94519","title":"MSRC Security Update Guide: CVE-2026-94519 Windows Graphics Kernel EoP","kind":"advisory","source":"analyst","publisher":null,"text":"Microsoft: Important, EoP, CVSS 7.0 (AV:L/AC:H/PR:L), attacker could gain SYSTEM, must win a race condition. Publicly disclosed: No. Exploited: No. Exploitability: Exploitation Less Likely. Released 2026-11-10 (Nov 2026 update). Customer action required.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118049,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94519","title":"NVD CVE-2026-94519 (Microsoft CNA affected builds)","kind":"other","source":"analyst","publisher":null,"text":"Affected per Microsoft CNA: Win11 24H2 10.0.26100.0 <10.0.26100.9974; 25H2 10.0.26200.0 <10.0.26200.9974; 26H1 10.0.28000.0 <10.0.28000.3501; 26H2 10.0.26300.0 <10.0.26300.9974; Server 2025 (and Server Core) 10.0.26100.0 <10.0.26100.33822.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}