{"id":"CVE-2026-95922","kind":"vulnerability","aliases":["CVE-2026-95922"],"related":[],"title":"Windows Graphics Kernel: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Graphics Kernel lets an attacker who already has a local account raise their privileges. The flaw is local only, so an attacker needs to be able to run code on the machine first.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","windows","windows-graphics-kernel"],"not_affected_if":["no-local-users"],"how_to_check":"Run winver or PowerShell [System.Environment]::OSVersion.Version (or cmd 'ver') and compare the full build.revision with the fixed build for your Windows version; lower means exposed.","fix":"Install the November 2026 Windows cumulative update that raises the OS build to at least the fixed build for your version (e.g. Windows 11 24H2/25H2: 10.0.26100.9974/26200.9974; Windows 10 22H2: 10.0.19045.7846; Server 2022: 10.0.20348.5870; Server 2025: 10.0.26100.33822). KB numbers not confirmed; see MSRC page.","status":"open","published_at":"2026-11-10T19:21:45+00:00","first_seen_at":"2026-11-10T19:25:23+00:00","triaged_at":"2026-11-10T19:49:50+00:00","updated_at":"2026-11-10T20:25:31+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:49:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Graphics Kernel: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Graphics Kernel lets an attacker who already has a local account raise their privileges. The flaw is local only, so an attacker needs to be able to run code on the machine first.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-graphics-kernel"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the machine","analyst_note":"Find the affected Windows builds and Microsoft's fixed update from the NVD entry and Microsoft Security Response Center advisory for CVE-2026-95922.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Any Windows machine with the affected Windows Graphics Kernel build can be exposed to a local user escalating privileges. Exposure depends on who can log in or run code on the machine; the sources do not list affected Windows builds. Systems with no untrusted local users are at lower risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000685,"input_tokens":4498,"output_tokens":471,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and Microsoft's fixed update from the NVD entry and Microsoft Security Response Center advisory for CVE-2026-95922.","search":"'-2026':14A,17A '-95922':15A,18A '10':20A,25A,30A,33A '11':36A,39A,42A,45A,48A '1607':21A '1809':26A '2016':23A '2019':28A '2022':52A '2025':55A '21h2':31A '22h2':34A '23h2':37A '24h2':40A '25h2':43A '26h1':46A '26h2':49A 'abl':100B 'account':85B 'allow':117C 'alreadi':81B 'attack':79B,96B,120C 'author':119C 'base':69B,110C 'buffer':70B,111C 'code':103B 'cve':13A,16A 'elev':122C 'escal':60B 'first':107B 'flaw':90B 'gain':10A 'graphic':2A,64B,75B,115C 'heap':4A,68B,109C 'heap-bas':67B,108C 'higher':11A 'infrastructur':56B 'kernel':3A,65B,76B,116C 'let':6A,77B 'local':8A,58B,84B,92B,124C 'local-privilege-escal':57B 'machin':106B 'need':97B 'overflow':5A,71B,112C 'privileg':12A,59B,88B,123C 'rais':86B 'run':102B 'server':22A,27A,51A,54A 'user':9A 'window':1A,61B,63B,74B,114C 'windows':19A,24A,29A,32A,35A,38A,41A,44A,47A,50A,53A 'windows-graphics-kernel':62B","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine with the affected Windows Graphics Kernel build can be exposed to a local user escalating privileges. Exposure depends on who can log in or run code on the machine; the sources do not list affected Windows builds. Systems with no untrusted local users are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","windows","windowsgraphicskernel"],"campaign_type":null,"search_a":"'-2026':14A,17A '-95922':15A,18A '10':20A,25A,30A,33A '11':36A,39A,42A,45A,48A '1607':21A '1809':26A '2016':23A '2019':28A '2022':52A '2025':55A '21h2':31A '22h2':34A '23h2':37A '24h2':40A '25h2':43A '26h1':46A '26h2':49A 'cve':13A,16A 'gain':10A 'graphic':2A 'heap':4A 'higher':11A 'kernel':3A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'server':22A,27A,51A,54A 'user':9A 'window':1A 'windows':19A,24A,29A,32A,35A,38A,41A,44A,47A,50A,53A","search_b":"'abl':100B 'account':85B 'alreadi':81B 'attack':79B,96B 'base':69B 'buffer':70B 'code':103B 'escal':60B 'first':107B 'flaw':90B 'graphic':64B,75B 'heap':68B 'heap-bas':67B 'infrastructur':56B 'kernel':65B,76B 'let':77B 'local':58B,84B,92B 'local-privilege-escal':57B 'machin':106B 'need':97B 'overflow':71B 'privileg':59B,88B 'rais':86B 'run':102B 'window':61B,63B,74B 'windows-graphics-kernel':62B","search_c":"'allow':117C 'attack':120C 'author':119C 'base':110C 'buffer':111C 'elev':122C 'graphic':115C 'heap':109C 'heap-bas':108C 'kernel':116C 'local':124C 'overflow':112C 'privileg':123C 'window':114C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95922","severity":null,"published_at":"2026-11-10T19:21:45+00:00","modified_at":"2026-11-10T19:21:45+00:00","first_seen_at":"2026-11-10T19:25:23+00:00","fetched_at":"2026-11-10T19:25:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95922:2655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95922","severity":null,"published_at":"2026-11-10T20:25:31+00:00","modified_at":"2026-11-10T20:25:31+00:00","first_seen_at":"2026-11-10T20:25:31+00:00","fetched_at":"2026-11-10T20:25:31+00:00","note":"MSRC page unreadable by tools; affected/fixed builds taken from NVD record (Microsoft CNA data). KB numbers unknown; nothing verified. No exploitation or PoC found.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-95922"]}],"documents":[{"id":118018,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95922","title":"NVD: CVE-2026-95922","kind":"advisory","source":"analyst","publisher":null,"text":"Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. CWE-122. CVSS 7.0 AV:L/AC:H/PR:L. Source Microsoft. Affected: Win10 1607 <10.0.14393.9688; 1809 <10.0.17763.9487; 21H2/22H2 <10.0.19044.7846/19045.7846; Win11 23H2 <22631.7711; 24H2/25H2 <26100.9974/26200.9974; 26H1 <28000.3501; 26H2 <26300.9974; Server 2016 <14393.9688; 2019 <17763.9487; 2022 <20348.5870; 2025 <26100.33822.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}