{"id":"CVE-2026-95909","kind":"vulnerability","aliases":["CVE-2026-95909"],"related":[],"title":"Windows Graphics Kernel: out-of-bounds read lets a local user gain privileges","description":"Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"A memory read past the end of a buffer in the Windows Graphics Kernel lets an authorized local user elevate their privileges. The attacker needs a valid account on the machine first.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"}],"ecosystems":[],"tags":["cwe-125","graphics-kernel","infrastructure","local-privilege-escalation","windows"],"not_affected_if":["no-local-users","patched-nov-2026"],"how_to_check":"Run winver or [Environment]::OSVersion in PowerShell and compare the build with the fixed build for your Windows version (see products). Builds below the fixed one are exposed. Confirm against the Microsoft Security Update Guide entry.","fix":"Install the November 10, 2026 Windows cumulative update, e.g. Windows 11 24H2/25H2: KB5132061 (build 26100/26200.9974); Windows 11 23H2: KB5131087 (build 22631.7711). Per-version fixed builds are in the product rows.","status":"open","published_at":"2026-11-10T19:21:44+00:00","first_seen_at":"2026-11-10T19:25:23+00:00","triaged_at":"2026-11-10T19:38:17+00:00","updated_at":"2026-11-10T20:27:37+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Graphics Kernel: out-of-bounds read lets a local user gain privileges","impact":"high","summary":"A memory read past the end of a buffer in the Windows Graphics Kernel lets an authorized local user elevate their privileges. The attacker needs a valid account on the machine first.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","graphics-kernel"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95909 for affected Windows builds and the patch.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Affects Windows machines where a user already has a local account; the sources do not list affected Windows builds. Remote attackers without a login are not described as able to exploit it. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000652,"input_tokens":4494,"output_tokens":406,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95909 for affected Windows builds and the patch.","search":"'-125':59B '-2026':16A,19A '-95909':17A,20A '10':22A,27A,32A,35A '11':38A,41A,44A,47A,50A '1607':23A '1809':28A '2016':25A '2019':30A '2022':54A '2025':57A '21h2':33A '22h2':36A '23h2':39A '24h2':42A '25h2':45A '26h1':48A '26h2':51A 'account':96B 'allow':110C 'attack':92B,113C 'author':85B,112C 'bound':7A,104C 'buffer':77B 'cve':15A,18A 'cwe':58B 'elev':88B,115C 'end':74B 'escal':67B 'first':100B 'gain':13A 'graphic':2A,61B,81B,108C 'graphics-kernel':60B 'infrastructur':63B 'kernel':3A,62B,82B,109C 'let':9A,83B 'local':11A,65B,86B,117C 'local-privilege-escal':64B 'machin':99B 'memori':70B 'need':93B 'out-of-bound':4A,101C 'past':72B 'privileg':14A,66B,90B,116C 'read':8A,71B,105C 'server':24A,29A,53A,56A 'user':12A,87B 'valid':95B 'window':1A,68B,80B,107C 'windows':21A,26A,31A,34A,37A,40A,43A,46A,49A,52A,55A","nicknames":[],"mitigations":[],"who_affected":"Windows 10, Windows 11 and Windows Server 2016 to 2025 machines where someone already has a local login, such as shared workstations, RDP/terminal servers, build machines and VDI. An attacker needs a local low-privilege account to gain higher privileges. Machines with no untrusted local users face little direct risk, but should still patch because the bug can be chained after another foothold.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["cwe125","graphicskernel","high","infrastructure","localprivilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':16A,19A '-95909':17A,20A '10':22A,27A,32A,35A '11':38A,41A,44A,47A,50A '1607':23A '1809':28A '2016':25A '2019':30A '2022':54A '2025':57A '21h2':33A '22h2':36A '23h2':39A '24h2':42A '25h2':45A '26h1':48A '26h2':51A 'bound':7A 'cve':15A,18A 'gain':13A 'graphic':2A 'kernel':3A 'let':9A 'local':11A 'out-of-bound':4A 'privileg':14A 'read':8A 'server':24A,29A,53A,56A 'user':12A 'window':1A 'windows':21A,26A,31A,34A,37A,40A,43A,46A,49A,52A,55A","search_b":"'-125':59B 'account':96B 'attack':92B 'author':85B 'buffer':77B 'cwe':58B 'elev':88B 'end':74B 'escal':67B 'first':100B 'graphic':61B,81B 'graphics-kernel':60B 'infrastructur':63B 'kernel':62B,82B 'let':83B 'local':65B,86B 'local-privilege-escal':64B 'machin':99B 'memori':70B 'need':93B 'past':72B 'privileg':66B,90B 'read':71B 'user':87B 'valid':95B 'window':68B,80B","search_c":"'allow':110C 'attack':113C 'author':112C 'bound':104C 'elev':115C 'graphic':108C 'kernel':109C 'local':117C 'out-of-bound':101C 'privileg':116C 'read':105C 'window':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95909","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95909","severity":null,"published_at":"2026-11-10T19:21:44+00:00","modified_at":"2026-11-10T19:21:44+00:00","first_seen_at":"2026-11-10T19:25:23+00:00","fetched_at":"2026-11-10T19:25:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95909:2657","url":"https://app.opencve.io/cve/CVE-2026-95909","severity":null,"published_at":"2026-11-10T20:27:37+00:00","modified_at":"2026-11-10T20:27:37+00:00","first_seen_at":"2026-11-10T20:27:37+00:00","fetched_at":"2026-11-10T20:27:37+00:00","note":"MSRC page unreadable by tools (JS only); versions taken from OpenCVE mirror of Microsoft CNA record, so nothing marked verified. Not exploited per CVSS E:U; no PoC found.","cites":["https://app.opencve.io/cve/CVE-2026-95909","https://winaero.com/patch-tuesday-cumulative-updates-for-windows-11-and-10-november-10-2026/"]}],"documents":[{"id":118026,"url":"https://app.opencve.io/cve/CVE-2026-95909","title":"OpenCVE: CVE-2026-95909 (mirrors Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":118027,"url":"https://winaero.com/patch-tuesday-cumulative-updates-for-windows-11-and-10-november-10-2026/","title":"Patch Tuesday cumulative updates, November 10, 2026","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}