---
id: "CVE-2026-94527"
page: "https://infrastack.ai/live/CVE-2026-94527"
kind: "vulnerability"
aliases: ["CVE-2026-94527"]
title: "Windows GDI: heap buffer overflow lets a local user gain higher privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 10/11 and Windows Server (GDI)", "fixed": ["Nov 10 2026 cumulative updates"], "affected": "Win10 1607/Server 2016 < 10.0.14393.9688; 1809/Server 2019 < 10.0.17763.9487; 21H2 < 10.0.19044.7846; 22H2 < 10.0.19045.7846; Win11 23H2 < 10.0.22631.7711; 24H2 < 10.0.26100.9974; 25H2 < 10.0.26200.9974; 26H1 < 10.0.28000.3501; 26H2 < 10.0.26300.9974; Server 2022 < 10.0.20348.5870; Server 2025 < 10.0.26100.33822", "ecosystem": "vendor"}]
ecosystems: []
tags: ["desktop", "gdi", "infrastructure", "local", "multi-user", "privilege-escalation", "windows"]
not_affected_if: ["no-local-users", "patched-nov-2026"]
published_at: "2026-11-10T19:21:38+00:00"
first_seen_at: "2026-11-10T19:25:21+00:00"
updated_at: "2026-11-10T20:36:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94527", "first_seen_at": "2026-11-10T19:25:21+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-94527", "first_seen_at": "2026-11-10T20:36:13+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-94527", "https://vulners.com/mscve/MS:CVE-2026-94527"]}]
exploit_sources: []
---

# Windows GDI: heap buffer overflow lets a local user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-94527 (this .md is for agents)

A heap-based buffer overflow (CWE-122, with an integer overflow, CWE-190) in Windows GDI lets a user who already has a local account gain higher privileges. Microsoft's CVSS is 7.8 (local, low complexity, no user interaction), with exploit code maturity 'unproven'. It was fixed in the November 10, 2026 Windows updates. Any Windows 10, 11 or Server machine without that update is affected; it matters most on shared systems such as terminal servers, VDI and developer or build machines where untrusted users or code can run locally.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows 10/11 and Windows Server (GDI) affected Win10 1607/Server 2016 < 10.0.14393.9688; 1809/Server 2019 < 10.0.17763.9487; 21H2 < 10.0.19044.7846; 22H2 < 10.0.19045.7846; Win11 23H2 < 10.0.22631.7711; 24H2 < 10.0.26100.9974; 25H2 < 10.0.26200.9974; 26H1 < 10.0.28000.3501; 26H2 < 10.0.26300.9974; Server 2022 < 10.0.20348.5870; Server 2025 < 10.0.26100.33822 fixed Nov 10 2026 cumulative updates

## How to check

Run winver or PowerShell (Get-ComputerInfo).OsBuildRevision and compare the full build with the fixed build: Win10 1607 and Server 2016 14393.9688, 1809 and Server 2019 17763.9487, 21H2 19044.7846, 22H2 19045.7846, Win11 23H2 22631.7711, Server 2022 20348.5870, Server 2025 26100.33822. For Win11 24H2/25H2/26H1/26H2 the mirrors list 26100.9974, 26200.9974, 28000.3501, 26300.9974; confirm on Microsoft's guide. Anything lower is exposed.

## Fix

Install the November 10, 2026 Windows cumulative update for your version (KB5131080 for 24H2/Server 2025, KB5131085 for 1809/2019, KB5131087 for 23H2, KB5131090 for Server 2022, KB5131096 for Win10 21H2/22H2, KB5131291 for 1607/Server 2016; hotpatch KB5131077). No workaround is documented.

## Timeline

- 2026-11-10T19:25:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94527
- 2026-11-10T20:36:13+00:00 analyst https://app.opencve.io/cve/CVE-2026-94527 — MSRC page is JS-only and unreadable; details come from OpenCVE/Vulners mirrors of Microsoft's CVE record, so nothing marked verified. Patched in Nov 10 2026 cumulative updates; no exploitation reported (CVSS E:U, not in KEV).

## Documents

- [describes] CVE-2026-94527 - OpenCVE (mirror of Microsoft CVE record) https://app.opencve.io/cve/CVE-2026-94527
- [describes] Windows GDI Elevation of Privilege Vulnerability - Vulners (MSRC mirror) https://vulners.com/mscve/MS:CVE-2026-94527

## From the sources

Heap-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_