{"id":"CVE-2026-94527","kind":"vulnerability","aliases":["CVE-2026-94527"],"related":[],"title":"Windows GDI: heap buffer overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow (CWE-122, with an integer overflow, CWE-190) in Windows GDI lets a user who already has a local account gain higher privileges. Microsoft's CVSS is 7.8 (local, low complexity, no user interaction), with exploit code maturity 'unproven'. It was fixed in the November 10, 2026 Windows updates. Any Windows 10, 11 or Server machine without that update is affected; it matters most on shared systems such as terminal servers, VDI and developer or build machines where untrusted users or code can run locally.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10/11 and Windows Server (GDI)","fixed":["Nov 10 2026 cumulative updates"],"affected":"Win10 1607/Server 2016 < 10.0.14393.9688; 1809/Server 2019 < 10.0.17763.9487; 21H2 < 10.0.19044.7846; 22H2 < 10.0.19045.7846; Win11 23H2 < 10.0.22631.7711; 24H2 < 10.0.26100.9974; 25H2 < 10.0.26200.9974; 26H1 < 10.0.28000.3501; 26H2 < 10.0.26300.9974; Server 2022 < 10.0.20348.5870; Server 2025 < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["desktop","gdi","infrastructure","local","multi-user","privilege-escalation","windows"],"not_affected_if":["no-local-users","patched-nov-2026"],"how_to_check":"Run winver or PowerShell (Get-ComputerInfo).OsBuildRevision and compare the full build with the fixed build: Win10 1607 and Server 2016 14393.9688, 1809 and Server 2019 17763.9487, 21H2 19044.7846, 22H2 19045.7846, Win11 23H2 22631.7711, Server 2022 20348.5870, Server 2025 26100.33822. For Win11 24H2/25H2/26H1/26H2 the mirrors list 26100.9974, 26200.9974, 28000.3501, 26300.9974; confirm on Microsoft's guide. Anything lower is exposed.","fix":"Install the November 10, 2026 Windows cumulative update for your version (KB5131080 for 24H2/Server 2025, KB5131085 for 1809/2019, KB5131087 for 23H2, KB5131090 for Server 2022, KB5131096 for Win10 21H2/22H2, KB5131291 for 1607/Server 2016; hotpatch KB5131077). No workaround is documented.","status":"open","published_at":"2026-11-10T19:21:38+00:00","first_seen_at":"2026-11-10T19:25:21+00:00","triaged_at":"2026-11-10T19:38:31+00:00","updated_at":"2026-11-10T20:36:13+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows GDI: heap buffer overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Graphics Device Interface (GDI) lets an attacker who already has a local account raise their privileges. The sources give no further detail on the trigger or the exact affected builds.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["windows","desktop","multi-user"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains elevated privileges on the Windows machine","analyst_note":"Check Microsoft's security update guide for CVE-2026-94527 for affected Windows builds, the patch, and any exploitation details; the NVD entry alone gives no versions.","how_to_check":"- unknown","plain_action":"Install the latest Windows security update from Microsoft as soon as it is available on your device.","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Machines running Windows where an untrusted or low-privilege user can log on or run code locally. Remote-only servers with no local user access are less exposed. The sources do not list the affected Windows builds.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000687,"input_tokens":4488,"output_tokens":476,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Microsoft's security update guide for CVE-2026-94527 for affected Windows builds, the patch, and any exploitation details; the NVD entry alone gives no versions.","search":"'-122':43B '-190':49B '-2026':14A,17A '-94527':15A,18A '10':87B,93B '10/11':20A '11':94B '2026':88B '7.8':69B 'account':61B 'affect':102B 'allow':135C 'alreadi':57B 'and':21A 'attack':138C 'author':137C 'base':39B,129C 'buffer':4A,40B,130C 'build':117B 'code':78B,123B 'complex':72B 'cve':13A,16A 'cvss':67B 'cwe':42B,48B 'desktop':25B 'develop':115B 'elev':140C 'escal':34B 'exploit':77B 'fix':83B 'gain':10A,62B 'gdi':2A,24A,26B,52B,134C 'heap':3A,38B,128C 'heap-bas':37B,127C 'higher':11A,63B 'infrastructur':27B 'integ':46B 'interact':75B 'let':6A,53B 'local':8A,28B,60B,70B,126B,142C 'low':71B 'machin':97B,118B 'matter':104B 'matur':79B 'microsoft':65B 'multi':30B 'multi-us':29B 'novemb':86B 'overflow':5A,41B,47B,131C 'privileg':12A,33B,64B,141C 'privilege-escal':32B 'run':125B 'server':23A,96B,112B 'share':107B 'system':108B 'termin':111B 'unproven':80B 'untrust':120B 'updat':90B,100B 'user':9A,31B,55B,74B,121B 'vdi':113B 'window':1A,35B,51B,89B,92B,133C 'windows':19A,22A 'without':98B","nicknames":[],"mitigations":[],"who_affected":"Machines running Windows where an untrusted or low-privilege user can log on or run code locally. Remote-only servers with no local user access are less exposed. The sources do not list the affected Windows builds.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["1011andwindowsservergdi","windows1011andwindowsservergdi"],"ptokens":["10","11","and","gdi","server","windows"],"labels":["desktop","gdi","high","infrastructure","local","multiuser","privilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-94527':15A,18A '10/11':20A 'and':21A 'buffer':4A 'cve':13A,16A 'gain':10A 'gdi':2A,24A 'heap':3A 'higher':11A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'server':23A 'user':9A 'window':1A 'windows':19A,22A","search_b":"'-122':43B '-190':49B '10':87B,93B '11':94B '2026':88B '7.8':69B 'account':61B 'affect':102B 'alreadi':57B 'base':39B 'buffer':40B 'build':117B 'code':78B,123B 'complex':72B 'cvss':67B 'cwe':42B,48B 'desktop':25B 'develop':115B 'escal':34B 'exploit':77B 'fix':83B 'gain':62B 'gdi':26B,52B 'heap':38B 'heap-bas':37B 'higher':63B 'infrastructur':27B 'integ':46B 'interact':75B 'let':53B 'local':28B,60B,70B,126B 'low':71B 'machin':97B,118B 'matter':104B 'matur':79B 'microsoft':65B 'multi':30B 'multi-us':29B 'novemb':86B 'overflow':41B,47B 'privileg':33B,64B 'privilege-escal':32B 'run':125B 'server':96B,112B 'share':107B 'system':108B 'termin':111B 'unproven':80B 'untrust':120B 'updat':90B,100B 'user':31B,55B,74B,121B 'vdi':113B 'window':35B,51B,89B,92B 'without':98B","search_c":"'allow':135C 'attack':138C 'author':137C 'base':129C 'buffer':130C 'elev':140C 'gdi':134C 'heap':128C 'heap-bas':127C 'local':142C 'overflow':131C 'privileg':141C 'window':133C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94527","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94527","severity":null,"published_at":"2026-11-10T19:21:38+00:00","modified_at":"2026-11-10T19:21:38+00:00","first_seen_at":"2026-11-10T19:25:21+00:00","fetched_at":"2026-11-10T19:25:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-94527:2677","url":"https://app.opencve.io/cve/CVE-2026-94527","severity":null,"published_at":"2026-11-10T20:36:13+00:00","modified_at":"2026-11-10T20:36:13+00:00","first_seen_at":"2026-11-10T20:36:13+00:00","fetched_at":"2026-11-10T20:36:13+00:00","note":"MSRC page is JS-only and unreadable; details come from OpenCVE/Vulners mirrors of Microsoft's CVE record, so nothing marked verified. Patched in Nov 10 2026 cumulative updates; no exploitation reported (CVSS E:U, not in KEV).","cites":["https://app.opencve.io/cve/CVE-2026-94527","https://vulners.com/mscve/MS:CVE-2026-94527"]}],"documents":[{"id":118050,"url":"https://app.opencve.io/cve/CVE-2026-94527","title":"CVE-2026-94527 - OpenCVE (mirror of Microsoft CVE record)","kind":"other","source":"analyst","publisher":null,"text":"Heap-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally. CVSS 3.1 7.8 AV:L/AC:L/PR:L/UI:N E:U/RL:O/RC:C. CWE-122, CWE-190. Affected: Win10 1607/2016 <10.0.14393.9688; 1809/2019 <10.0.17763.9487; 21H2 <10.0.19044.7846; 22H2 <10.0.19045.7846; Win11 23H2 <10.0.22631.7711; 24H2 <10.0.26100.9974; 25H2 <10.0.26200.9974; 26H1 <10.0.28000.3501; 26H2 <10.0.26300.9974; Server 2022 <10.0.20348.5870; Server 2025 <10.0.26100.33822. Not in KEV.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":118051,"url":"https://vulners.com/mscve/MS:CVE-2026-94527","title":"Windows GDI Elevation of Privilege Vulnerability - Vulners (MSRC mirror)","kind":"other","source":"analyst","publisher":null,"text":"Mirror of MSRC entry, 10 Nov 2026. Fixed by November 10, 2026 cumulative updates: KB5131080 (Win11 24H2/Server 2025, 26100.33822), KB5131077 (Hotpatch 26100.33730), KB5131085 (17763.9487), KB5131087 (22631.7711), KB5131090 (20348.5870), KB5131096 (19045/19044.7846), KB5131291 (14393.9688).","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}