{"id":"CVE-2026-95932","kind":"vulnerability","aliases":["CVE-2026-95932"],"related":[],"title":"Windows Graphics Kernel: local user can elevate privileges to administrator","description":"Inclusion of functionality from untrusted control sphere in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"A flaw in the Windows Graphics Kernel lets an authorized attacker load functionality from an untrusted control sphere. An attacker with local access can use it to elevate privileges.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","local-privilege-escalation","windows"],"not_affected_if":["no-local-user-access"],"how_to_check":"Run winver, or in PowerShell: Get-HotFix. Look up CVE-2026-95932 in Microsoft's Security Update Guide to get the KB for your Windows edition. Per Windows Report, the November 10, 2026 cumulative updates are KB5132061 (Windows 11 24H2/25H2/26H2), KB5131087 (23H2) and KB5132059 (26H1). I did not confirm that these contain this fix.","fix":"Install the November 2026 (2026-11-10) Windows cumulative update for your edition via Windows Update. The exact KB and build for this CVE are not confirmed.","status":"open","published_at":"2026-11-10T19:21:45+00:00","first_seen_at":"2026-11-10T19:25:24+00:00","triaged_at":"2026-11-10T19:38:17+00:00","updated_at":"2026-11-10T20:25:35+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:38:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Graphics Kernel: local user can elevate privileges to administrator","impact":"high","summary":"A flaw in the Windows Graphics Kernel lets an authorized attacker load functionality from an untrusted control sphere. An attacker with local access can use it to elevate privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","endpoints"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains kernel-level SYSTEM privileges on the machine","analyst_note":"Confirm affected Windows builds and the Microsoft security update that fixes CVE-2026-95932 from the MSRC advisory.","how_to_check":"- Check the installed Windows build with `winver` and compare it against Microsoft's security update guide for this CVE.\n- Confirm Windows Update has applied the latest cumulative update.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-user-access"],"who_is_affected":"Any Windows machine where a user already has a local account can be exposed; the flaw is in the kernel graphics component. The sources do not name the affected Windows builds. Machines with no untrusted local users may carry lower risk, but this is not stated in the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":4505,"output_tokens":497,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Windows builds and the Microsoft security update that fixes CVE-2026-95932 from the MSRC advisory.","search":"'-2026':12A,15A '-95932':13A,16A 'access':46B 'administr':10A 'allow':64C 'attack':34B,43B,67C 'author':33B,66C 'control':40B,58C 'cve':11A,14A 'elev':7A,51B,69C 'endpoint':17B 'escal':22B 'flaw':25B 'function':36B,55C 'graphic':2A,29B,62C 'inclus':53C 'infrastructur':18B 'kernel':3A,30B,63C 'let':31B 'load':35B 'local':4A,20B,45B,71C 'local-privilege-escal':19B 'privileg':8A,21B,52B,70C 'sphere':41B,59C 'untrust':39B,57C 'use':48B 'user':5A 'window':1A,23B,28B,61C","nicknames":[],"mitigations":[],"who_affected":"Windows machines where a local user or process can run code and could use the Graphics Kernel flaw to become administrator. This matters most on shared machines, terminal servers, VDI and developer workstations. Affected builds are not confirmed yet. Machines that are fully patched with the November 2026 updates can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["endpoints","high","infrastructure","localprivilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':12A,15A '-95932':13A,16A 'administr':10A 'cve':11A,14A 'elev':7A 'graphic':2A 'kernel':3A 'local':4A 'privileg':8A 'user':5A 'window':1A","search_b":"'access':46B 'attack':34B,43B 'author':33B 'control':40B 'elev':51B 'endpoint':17B 'escal':22B 'flaw':25B 'function':36B 'graphic':29B 'infrastructur':18B 'kernel':30B 'let':31B 'load':35B 'local':20B,45B 'local-privilege-escal':19B 'privileg':21B,52B 'sphere':41B 'untrust':39B 'use':48B 'window':23B,28B","search_c":"'allow':64C 'attack':67C 'author':66C 'control':58C 'elev':69C 'function':55C 'graphic':62C 'inclus':53C 'kernel':63C 'local':71C 'privileg':70C 'sphere':59C 'untrust':57C 'window':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95932","severity":null,"published_at":"2026-11-10T19:21:45+00:00","modified_at":"2026-11-10T19:21:45+00:00","first_seen_at":"2026-11-10T19:25:24+00:00","fetched_at":"2026-11-10T19:25:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95932:2653","url":"https://api.msrc.microsoft.com/cvrf/v3.0/updates/CVE-2026-95932","severity":null,"published_at":"2026-11-10T20:25:35+00:00","modified_at":"2026-11-10T20:25:35+00:00","first_seen_at":"2026-11-10T20:25:35+00:00","fetched_at":"2026-11-10T20:25:35+00:00","note":"MSRC CVRF API confirms the CVE ships in the November 2026 Security Updates (2026-11-10). The Security Update Guide page is JS-only and the CVRF document returned nothing, so affected builds and KB per SKU are unconfirmed. Nothing verified. No exploitation or PoC found.","cites":["https://api.msrc.microsoft.com/cvrf/v3.0/updates/CVE-2026-95932","https://windowsreport.com/windows-11-kb5132061-kb5131087-kb5132059-november-2026-patch-tuesday-updates-out-now/"]}],"documents":[{"id":118019,"url":"https://api.msrc.microsoft.com/cvrf/v3.0/updates/CVE-2026-95932","title":"MSRC CVRF: CVE-2026-95932 is in the November 2026 Security Updates","kind":"advisory","source":"analyst","publisher":null,"text":"MSRC API lists CVE-2026-95932 under 2026-Nov, November 2026 Security Updates, released 2026-11-10.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":118020,"url":"https://windowsreport.com/windows-11-kb5132061-kb5131087-kb5132059-november-2026-patch-tuesday-updates-out-now/","title":"Windows 11 November 2026 Patch Tuesday updates","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}