{"id":"CVE-2026-95938","kind":"vulnerability","aliases":["CVE-2026-95938"],"related":[],"title":"Windows Graphics Kernel: heap overflow lets a local user gain system privileges","description":"Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Graphics Kernel lets an attacker who already has a local account raise their privileges. The attacker needs to be authorized on the machine first.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["graphics-kernel","infrastructure","self-hosted","windows"],"not_affected_if":["no-local-users","patched-windows"],"how_to_check":"- Check the Windows build with `winver` and compare it against the fixed build in Microsoft's security update guide for CVE-2026-95938\n- Confirm the latest cumulative Windows update is installed with `wmic qfe list` or Settings > Windows Update","fix":null,"status":"open","published_at":"2026-11-10T19:21:46+00:00","first_seen_at":"2026-11-10T19:25:24+00:00","triaged_at":"2026-11-10T19:49:50+00:00","updated_at":"2026-11-10T20:23:39+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-10T19:49:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Graphics Kernel: heap overflow lets a local user gain system privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Graphics Kernel lets an attacker who already has a local account raise their privileges. The attacker needs to be authorized on the machine first.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","graphics-kernel","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level control of the Windows machine","analyst_note":"Sources give only the NVD description; check the Microsoft Security Response Center entry for CVE-2026-95938 for affected builds and the fixed update.","how_to_check":"- Check the Windows build with `winver` and compare it against the fixed build in Microsoft's security update guide for CVE-2026-95938\n- Confirm the latest cumulative Windows update is installed with `wmic qfe list` or Settings > Windows Update","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users","patched-windows"],"who_is_affected":"Any Windows machine where users have local accounts is in scope, because the flaw is reached from a logged-in session rather than the network. Servers and workstations running the affected Windows Graphics Kernel builds should be checked. Machines with no untrusted local users carry lower practical risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00072,"input_tokens":4498,"output_tokens":541,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give only the NVD description; check the Microsoft Security Response Center entry for CVE-2026-95938 for affected builds and the fixed update.","search":"'-2026':14A,17A '-95938':15A,18A 'account':46B 'allow':69C 'alreadi':42B 'attack':40B,51B,72C 'author':55B,71C 'base':30B,62C 'buffer':31B,63C 'cve':13A,16A 'elev':74C 'first':59B 'gain':10A 'graphic':2A,20B,36B,67C 'graphics-kernel':19B 'heap':4A,29B,61C 'heap-bas':28B,60C 'host':25B 'infrastructur':22B 'kernel':3A,21B,37B,68C 'let':6A,38B 'local':8A,45B,76C 'machin':58B 'need':52B 'overflow':5A,32B,64C 'privileg':12A,49B,75C 'rais':47B 'self':24B 'self-host':23B 'system':11A 'user':9A 'window':1A,26B,35B,66C","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine where users have local accounts is in scope, because the flaw is reached from a logged-in session rather than the network. Servers and workstations running the affected Windows Graphics Kernel builds should be checked. Machines with no untrusted local users carry lower practical risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["graphicskernel","high","infrastructure","selfhosted","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-95938':15A,18A 'cve':13A,16A 'gain':10A 'graphic':2A 'heap':4A 'kernel':3A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'system':11A 'user':9A 'window':1A","search_b":"'account':46B 'alreadi':42B 'attack':40B,51B 'author':55B 'base':30B 'buffer':31B 'first':59B 'graphic':20B,36B 'graphics-kernel':19B 'heap':29B 'heap-bas':28B 'host':25B 'infrastructur':22B 'kernel':21B,37B 'let':38B 'local':45B 'machin':58B 'need':52B 'overflow':32B 'privileg':49B 'rais':47B 'self':24B 'self-host':23B 'window':26B,35B","search_c":"'allow':69C 'attack':72C 'author':71C 'base':62C 'buffer':63C 'elev':74C 'graphic':67C 'heap':61C 'heap-bas':60C 'kernel':68C 'local':76C 'overflow':64C 'privileg':75C 'window':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95938","severity":null,"published_at":"2026-11-10T19:21:46+00:00","modified_at":"2026-11-10T19:21:46+00:00","first_seen_at":"2026-11-10T19:25:24+00:00","fetched_at":"2026-11-10T19:25:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95938:2649","url":null,"severity":null,"published_at":"2026-11-10T20:23:39+00:00","modified_at":"2026-11-10T20:23:39+00:00","first_seen_at":"2026-11-10T20:23:39+00:00","fetched_at":"2026-11-10T20:23:39+00:00","note":"MSRC page is JS-only (WebFetch empty), NVD page returned no content, MSRC CVRF feed too large to fetch; web-cli unavailable in this session. No primary source read, so no affected builds, KB or fixed version; nothing verified. Needs MSRC entry via browser-cli or Update Guide to settle fix and builds. Left severity, tags and summary as triage had them."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}