{"id":"CVE-2026-95895","kind":"vulnerability","aliases":["CVE-2026-95895"],"related":[],"title":"Windows Graphics Kernel: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free in the Windows Graphics Kernel lets a low-privileged local user raise privileges (CVSS 7.8, local, no user interaction). Any Windows machine on the listed builds where untrusted users can run code (shared workstations, RDP or terminal servers, dev boxes, CI runners) is exposed. It is not remotely exploitable on its own; patched machines, or machines where no untrusted user can run code, can wait for the normal patch cycle. No exploitation reported.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1809","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":">= 10.0.19044.0, < 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">= 10.0.22631.0, < 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9911"],"affected":">= 10.0.26100.0, < 10.0.26100.9911","ecosystem":"microsoft"}],"ecosystems":[],"tags":["graphics-kernel","infrastructure","local-privilege-escalation","use-after-free","windows"],"not_affected_if":["patched-build"],"how_to_check":"Run winver or PowerShell [System.Environment]::OSVersion.Version and compare the full build (e.g. 10.0.19045.xxxx) with the fixed builds in the fix field. Lower means exposed. Servers and other Windows versions: check the MSRC entry for CVE-2026-95895.","fix":"Install the November 2026 Windows cumulative update; fixed builds per the CVE record: Win10 1809 10.0.17763.9487, Win10 21H2 10.0.19044.7846, Win10 22H2 10.0.19045.7846, Win11 23H2 10.0.22631.7711, Win11 24H2 10.0.26100.9911. KB numbers unknown (see MSRC entry).","status":"open","published_at":"2026-11-10T19:21:42+00:00","first_seen_at":"2026-11-10T19:25:23+00:00","triaged_at":"2026-11-10T19:38:21+00:00","updated_at":"2026-11-10T20:28:45+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Graphics Kernel: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A memory-safety bug (use after free) in the Windows Graphics Kernel lets an attacker who already has a local account raise their privileges. The source gives a CVSS score of 7.8 (high) and reports no known exploitation.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Check Microsoft's security update guide entry for CVE-2026-95895 for affected Windows builds and the patch KB.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Any Windows machine with the affected Graphics Kernel build is exposed to a local user with an account. The sources do not name affected Windows versions or builds. Systems where only trusted administrators log on carry less practical risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":4484,"output_tokens":428,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Microsoft's security update guide entry for CVE-2026-95895 for affected Windows builds and the patch KB.","search":"'-2026':16A,19A '-95895':17A,20A '10':22A,25A,28A '11':31A,34A '1809':23A '21h2':26A '22h2':29A '23h2':32A '24h2':35A '7.8':69B 'allow':135C 'attack':138C 'author':137C 'box':94B 'build':80B 'ci':95B 'code':86B,117B 'cve':15A,18A 'cvss':68B 'cycl':124B 'dev':93B 'elev':140C 'escal':43B 'exploit':103B,126B 'expos':98B 'free':7A,47B,53B,130C 'gain':12A 'graphic':2A,37B,57B,133C 'graphics-kernel':36B 'higher':13A 'infrastructur':39B 'interact':73B 'kernel':3A,38B,58B,134C 'let':8A,59B 'list':79B 'local':10A,41B,64B,70B,142C 'local-privilege-escal':40B 'low':62B 'low-privileg':61B 'machin':76B,108B,110B 'normal':122B 'patch':107B,123B 'privileg':14A,42B,63B,67B,141C 'rais':66B 'rdp':89B 'remot':102B 'report':127B 'run':85B,116B 'runner':96B 'server':92B 'share':87B 'termin':91B 'untrust':82B,113B 'use':5A,45B,51B,128C 'use-after-fre':4A,44B,50B 'user':11A,65B,72B,83B,114B 'wait':119B 'window':1A,48B,56B,75B,132C 'windows':21A,24A,27A,30A,33A 'workstat':88B","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine with the affected Graphics Kernel build is exposed to a local user with an account. The sources do not name affected Windows versions or builds. Systems where only trusted administrators log on carry less practical risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101809","1021h2","1022h2","1123h2","1124h2","windows101809","windows1021h2","windows1022h2","windows1123h2","windows1124h2"],"ptokens":["10","11","1809","21h2","22h2","23h2","24h2","windows"],"labels":["graphicskernel","high","infrastructure","localprivilegeescalation","useafterfree","windows"],"campaign_type":null,"search_a":"'-2026':16A,19A '-95895':17A,20A '10':22A,25A,28A '11':31A,34A '1809':23A '21h2':26A '22h2':29A '23h2':32A '24h2':35A 'cve':15A,18A 'free':7A 'gain':12A 'graphic':2A 'higher':13A 'kernel':3A 'let':8A 'local':10A 'privileg':14A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A 'windows':21A,24A,27A,30A,33A","search_b":"'7.8':69B 'box':94B 'build':80B 'ci':95B 'code':86B,117B 'cvss':68B 'cycl':124B 'dev':93B 'escal':43B 'exploit':103B,126B 'expos':98B 'free':47B,53B 'graphic':37B,57B 'graphics-kernel':36B 'infrastructur':39B 'interact':73B 'kernel':38B,58B 'let':59B 'list':79B 'local':41B,64B,70B 'local-privilege-escal':40B 'low':62B 'low-privileg':61B 'machin':76B,108B,110B 'normal':122B 'patch':107B,123B 'privileg':42B,63B,67B 'rais':66B 'rdp':89B 'remot':102B 'report':127B 'run':85B,116B 'runner':96B 'server':92B 'share':87B 'termin':91B 'untrust':82B,113B 'use':45B,51B 'use-after-fre':44B,50B 'user':65B,72B,83B,114B 'wait':119B 'window':48B,56B,75B 'workstat':88B","search_c":"'allow':135C 'attack':138C 'author':137C 'elev':140C 'free':130C 'graphic':133C 'kernel':134C 'local':142C 'privileg':141C 'use':128C 'window':132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95895","severity":null,"published_at":"2026-11-10T19:21:42+00:00","modified_at":"2026-11-10T19:21:43+00:00","first_seen_at":"2026-11-10T19:25:23+00:00","fetched_at":"2026-11-10T19:25:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95895:2662","url":"https://radar.offseq.com/threat/cve-2026-95895-cwe-416-use-after-free-in-microsoft-windows-10-version-1809-841ef4a829a9cfbc","severity":null,"published_at":"2026-11-10T20:28:45+00:00","modified_at":"2026-11-10T20:28:45+00:00","first_seen_at":"2026-11-10T20:28:45+00:00","fetched_at":"2026-11-10T20:28:45+00:00","note":"MSRC page is JS-only and unreadable here; NVD fetch empty. Versions come from OffSeq's copy of the CVE record (secondary), so nothing is marked verified. The OffSeq page says '+7' more fixed builds than the 6 rows listed; the full list and KB numbers need the MSRC page. No exploitation or PoC reported (not in KEV per OffSeq).","cites":["https://radar.offseq.com/threat/cve-2026-95895-cwe-416-use-after-free-in-microsoft-windows-10-version-1809-841ef4a829a9cfbc"]}],"documents":[{"id":118032,"url":"https://radar.offseq.com/threat/cve-2026-95895-cwe-416-use-after-free-in-microsoft-windows-10-version-1809-841ef4a829a9cfbc","title":"OffSeq Threat Radar: CVE-2026-95895 (mirror of CVE record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}