---
id: "CVE-2026-95895"
page: "https://infrastack.ai/live/CVE-2026-95895"
kind: "vulnerability"
aliases: ["CVE-2026-95895"]
title: "Windows Graphics Kernel: use-after-free lets a local user gain higher privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 10 1809", "fixed": ["10.0.17763.9487"], "affected": ">= 10.0.17763.0, < 10.0.17763.9487", "ecosystem": "microsoft"}, {"name": "Windows 10 21H2", "fixed": ["10.0.19044.7846"], "affected": ">= 10.0.19044.0, < 10.0.19044.7846", "ecosystem": "microsoft"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": ">= 10.0.19045.0, < 10.0.19045.7846", "ecosystem": "microsoft"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": ">= 10.0.22631.0, < 10.0.22631.7711", "ecosystem": "microsoft"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9911"], "affected": ">= 10.0.26100.0, < 10.0.26100.9911", "ecosystem": "microsoft"}]
ecosystems: []
tags: ["graphics-kernel", "infrastructure", "local-privilege-escalation", "use-after-free", "windows"]
not_affected_if: ["patched-build"]
published_at: "2026-11-10T19:21:42+00:00"
first_seen_at: "2026-11-10T19:25:23+00:00"
updated_at: "2026-11-10T20:28:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95895", "first_seen_at": "2026-11-10T19:25:23+00:00"}, {"source": "analyst", "url": "https://radar.offseq.com/threat/cve-2026-95895-cwe-416-use-after-free-in-microsoft-windows-10-version-1809-841ef4a829a9cfbc", "first_seen_at": "2026-11-10T20:28:45+00:00", "cites": ["https://radar.offseq.com/threat/cve-2026-95895-cwe-416-use-after-free-in-microsoft-windows-10-version-1809-841ef4a829a9cfbc"]}]
exploit_sources: []
---

# Windows Graphics Kernel: use-after-free lets a local user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-95895 (this .md is for agents)

A use-after-free in the Windows Graphics Kernel lets a low-privileged local user raise privileges (CVSS 7.8, local, no user interaction). Any Windows machine on the listed builds where untrusted users can run code (shared workstations, RDP or terminal servers, dev boxes, CI runners) is exposed. It is not remotely exploitable on its own; patched machines, or machines where no untrusted user can run code, can wait for the normal patch cycle. No exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- microsoft:Windows 10 1809 affected >= 10.0.17763.0, < 10.0.17763.9487 fixed 10.0.17763.9487
- microsoft:Windows 10 21H2 affected >= 10.0.19044.0, < 10.0.19044.7846 fixed 10.0.19044.7846
- microsoft:Windows 10 22H2 affected >= 10.0.19045.0, < 10.0.19045.7846 fixed 10.0.19045.7846
- microsoft:Windows 11 23H2 affected >= 10.0.22631.0, < 10.0.22631.7711 fixed 10.0.22631.7711
- microsoft:Windows 11 24H2 affected >= 10.0.26100.0, < 10.0.26100.9911 fixed 10.0.26100.9911

## How to check

Run winver or PowerShell [System.Environment]::OSVersion.Version and compare the full build (e.g. 10.0.19045.xxxx) with the fixed builds in the fix field. Lower means exposed. Servers and other Windows versions: check the MSRC entry for CVE-2026-95895.

## Fix

Install the November 2026 Windows cumulative update; fixed builds per the CVE record: Win10 1809 10.0.17763.9487, Win10 21H2 10.0.19044.7846, Win10 22H2 10.0.19045.7846, Win11 23H2 10.0.22631.7711, Win11 24H2 10.0.26100.9911. KB numbers unknown (see MSRC entry).

## Timeline

- 2026-11-10T19:25:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95895
- 2026-11-10T20:28:45+00:00 analyst https://radar.offseq.com/threat/cve-2026-95895-cwe-416-use-after-free-in-microsoft-windows-10-version-1809-841ef4a829a9cfbc — MSRC page is JS-only and unreadable here; NVD fetch empty. Versions come from OffSeq's copy of the CVE record (secondary), so nothing is marked verified. The OffSeq page says '+7' more fixed builds than the 6 rows listed; the full list and KB numbers need the MSRC page. No exploitation or PoC reported (not in KEV per OffSeq).

## Documents

- [describes] OffSeq Threat Radar: CVE-2026-95895 (mirror of CVE record) https://radar.offseq.com/threat/cve-2026-95895-cwe-416-use-after-free-in-microsoft-windows-10-version-1809-841ef4a829a9cfbc

## From the sources

Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_