{"id":"CVE-2026-95948","kind":"vulnerability","aliases":["CVE-2026-95948"],"related":[],"title":"Windows Graphics Kernel: stack overflow lets a local user gain higher privileges","description":"Stack-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"A stack-based buffer overflow in the Windows Graphics Kernel lets an attacker who already has a local account run code with higher privileges. The sources give a CVSS score of 7.8 and no details on the exact trigger.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 / Server 2016 (1607)","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"microsoft"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"}],"ecosystems":[],"tags":["endpoints","infrastructure","local","privilege-escalation","windows"],"not_affected_if":["no-local-untrusted-users","patched-november-2026"],"how_to_check":"Run winver or [System.Environment]::OSVersion in PowerShell and compare the build (major.UBR) with the fixed builds listed; installed November 2026 cumulative update at or above the fixed build means patched. Confirm the KB number on the MSRC page for CVE-2026-95948.","fix":"Install the November 2026 Windows cumulative update. Fixed builds per Microsoft's CVE record: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. KB numbers not confirmed.","status":"open","published_at":"2026-11-10T19:21:47+00:00","first_seen_at":"2026-11-10T19:25:24+00:00","triaged_at":"2026-11-10T19:38:10+00:00","updated_at":"2026-11-10T20:22:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Graphics Kernel: stack overflow lets a local user gain higher privileges","impact":"high","summary":"A stack-based buffer overflow in the Windows Graphics Kernel lets an attacker who already has a local account run code with higher privileges. The sources give a CVSS score of 7.8 and no details on the exact trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","endpoints"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level control of the machine","analyst_note":"Check the Microsoft Security Update Guide entry for this CVE to find affected Windows builds and the fixed update.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Any Windows machine where an untrusted or low-privilege user can log on or run code is potentially exposed, since the flaw requires an authorized local attacker. The sources do not name specific Windows builds or the patch that closes it. Systems where only administrators use the machine carry less practical risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00068,"input_tokens":4498,"output_tokens":461,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for this CVE to find affected Windows builds and the fixed update.","search":"'-2026':14A,17A '-95948':15A,18A '10':20A,25A,30A,33A '11':36A,39A,42A,45A,48A '1607':23A '1809':26A '2016':22A '2019':28A '2022':52A '2025':55A '21h2':31A '22h2':34A '23h2':37A '24h2':40A '25h2':43A '26h1':46A '26h2':49A '7.8':95B 'account':82B 'allow':112C 'alreadi':78B 'attack':76B,115C 'author':114C 'base':66B,105C 'buffer':67B,106C 'code':84B 'cve':13A,16A 'cvss':92B 'detail':98B 'elev':117C 'endpoint':56B 'escal':61B 'exact':101B 'gain':10A 'give':90B 'graphic':2A,72B,110C 'higher':11A,86B 'infrastructur':57B 'kernel':3A,73B,111C 'let':6A,74B 'local':8A,58B,81B,119C 'overflow':5A,68B,107C 'privileg':12A,60B,87B,118C 'privilege-escal':59B 'run':83B 'score':93B 'server':21A,27A,51A,54A 'sourc':89B 'stack':4A,65B,104C 'stack-bas':64B,103C 'trigger':102B 'user':9A 'window':1A,62B,71B,109C 'windows':19A,24A,29A,32A,35A,38A,41A,44A,47A,50A,53A","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine where an untrusted or low-privilege user can log on or run code is potentially exposed, since the flaw requires an authorized local attacker. The sources do not name specific Windows builds or the patch that closes it. Systems where only administrators use the machine carry less practical risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101809server2019","1021h2","1022h2","10server20161607","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101809server2019","windows1021h2","windows1022h2","windows10server20161607","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["endpoints","high","infrastructure","local","privilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-95948':15A,18A '10':20A,25A,30A,33A '11':36A,39A,42A,45A,48A '1607':23A '1809':26A '2016':22A '2019':28A '2022':52A '2025':55A '21h2':31A '22h2':34A '23h2':37A '24h2':40A '25h2':43A '26h1':46A '26h2':49A 'cve':13A,16A 'gain':10A 'graphic':2A 'higher':11A 'kernel':3A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'server':21A,27A,51A,54A 'stack':4A 'user':9A 'window':1A 'windows':19A,24A,29A,32A,35A,38A,41A,44A,47A,50A,53A","search_b":"'7.8':95B 'account':82B 'alreadi':78B 'attack':76B 'base':66B 'buffer':67B 'code':84B 'cvss':92B 'detail':98B 'endpoint':56B 'escal':61B 'exact':101B 'give':90B 'graphic':72B 'higher':86B 'infrastructur':57B 'kernel':73B 'let':74B 'local':58B,81B 'overflow':68B 'privileg':60B,87B 'privilege-escal':59B 'run':83B 'score':93B 'sourc':89B 'stack':65B 'stack-bas':64B 'trigger':102B 'window':62B,71B","search_c":"'allow':112C 'attack':115C 'author':114C 'base':105C 'buffer':106C 'elev':117C 'graphic':110C 'kernel':111C 'local':119C 'overflow':107C 'privileg':118C 'stack':104C 'stack-bas':103C 'window':109C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95948","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95948","severity":null,"published_at":"2026-11-10T19:21:47+00:00","modified_at":"2026-11-10T19:21:47+00:00","first_seen_at":"2026-11-10T19:25:24+00:00","fetched_at":"2026-11-10T19:25:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95948:2646","url":"https://app.opencve.io/cve/CVE-2026-95948","severity":null,"published_at":"2026-11-10T20:22:04+00:00","modified_at":"2026-11-10T20:22:04+00:00","first_seen_at":"2026-11-10T20:22:04+00:00","fetched_at":"2026-11-10T20:22:04+00:00","note":"MSRC page not readable via web-cli; build ranges taken from OpenCVE mirror of Microsoft CNA record (secondary), so nothing marked verified. Exploit maturity E:U in vector, no PoC found, no exploitation reported.","cites":["https://app.opencve.io/cve/CVE-2026-95948"]}],"documents":[{"id":118013,"url":"https://app.opencve.io/cve/CVE-2026-95948","title":"OpenCVE: CVE-2026-95948 (mirrors Microsoft CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}