---
id: "CVE-2026-95935"
page: "https://infrastack.ai/live/CVE-2026-95935"
kind: "vulnerability"
aliases: ["CVE-2026-95935"]
title: "Windows Graphics Kernel: integer overflow lets a local user gain privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "local-privilege-escalation", "windows"]
not_affected_if: ["no-local-untrusted-users"]
published_at: "2026-11-10T19:21:46+00:00"
first_seen_at: "2026-11-10T19:25:24+00:00"
updated_at: "2026-11-10T20:23:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95935", "first_seen_at": "2026-11-10T19:25:24+00:00"}, {"source": "analyst", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95935", "first_seen_at": "2026-11-10T20:23:53+00:00", "cites": ["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95935"]}]
exploit_sources: []
---

# Windows Graphics Kernel: integer overflow lets a local user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-95935 (this .md is for agents)

An integer overflow in the Windows Graphics Kernel lets a local user with a low-privilege account gain SYSTEM rights. Microsoft rates exploitation as more likely; it is not exploited and not publicly disclosed as of its record.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Compare the installed Windows build against the fixed build in the MSRC entry for CVE-2026-95935 (November 2026 release); in PowerShell run Get-HotFix or winver. The fixed KB and builds could not be read from the MSRC record (page is JavaScript-only), so check the update guide directly.

## Fix

Install the November 2026 Windows cumulative update from Microsoft. Exact KB and build numbers not confirmed: see the MSRC entry.

## Timeline

- 2026-11-10T19:25:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95935
- 2026-11-10T20:23:53+00:00 analyst https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95935 — MSRC record read via its API: Nov 2026 release, CVSS 7.8, Exploitation More Likely, not exploited, no affected builds or KB in the text I could read. Nothing marked verified. Fix and builds still unknown. X and web search not used.

## Documents

- [advisory] MSRC: CVE-2026-95935 Windows Graphics Kernel EoP https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95935

## From the sources

Integer overflow or wraparound in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_