---
id: "CVE-2026-95942"
page: "https://infrastack.ai/live/CVE-2026-95942"
kind: "vulnerability"
aliases: ["CVE-2026-95942"]
title: "Windows Graphics Kernel: out-of-bounds read lets a local user gain privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["desktop", "infrastructure", "local-privilege-escalation", "servers", "windows"]
not_affected_if: ["no-local-untrusted-users"]
published_at: "2026-11-10T19:21:46+00:00"
first_seen_at: "2026-11-10T19:25:24+00:00"
updated_at: "2026-11-10T20:21:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95942", "first_seen_at": "2026-11-10T19:25:24+00:00"}, {"source": "analyst", "url": "https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95942", "first_seen_at": "2026-11-10T20:21:59+00:00", "cites": ["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95942"]}]
exploit_sources: []
---

# Windows Graphics Kernel: out-of-bounds read lets a local user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-95942 (this .md is for agents)

An out-of-bounds read in the Windows Graphics Kernel lets a local user with a low-privilege account gain SYSTEM privileges. Microsoft rates it Important (CVSS 7.8), 'Exploitation Less Likely', not exploited and not publicly disclosed at the time of the advisory data. Affected builds and the fixing KB were not available to the analyst.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run winver, then compare your build with the fixed build/KB listed for CVE-2026-95942 in the Microsoft Security Update Guide (affected builds not confirmed by the analyst). Check installed updates with: Get-HotFix

## Timeline

- 2026-11-10T19:25:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95942
- 2026-11-10T20:21:59+00:00 analyst https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95942 — MSRC data (via Update Guide API, fetched through WebFetch summary) gives CVSS 7.8 Important, local/low priv/no UI, SYSTEM impact, 'Exploitation Less Likely', not exploited, not publicly disclosed. Affected builds and fixed KB not retrievable (MSRC page is JS-only, web-cli returned empty). Nothing verified. Fix stays unknown; settle by opening the Update Guide page in a browser. X/community search not done (low-value for B tier).

## Documents

- [advisory] MSRC Update Guide: CVE-2026-95942 (Windows Graphics Kernel) https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95942

## From the sources

Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_