{"id":"CVE-2026-95950","kind":"vulnerability","aliases":["CVE-2026-95950"],"related":[],"title":"Windows Graphics Kernel: out-of-bounds read lets a local user gain privileges","description":"Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"Microsoft's November 2026 Patch Tuesday fixes an out-of-bounds read in the Windows Graphics Kernel. A local attacker with a low-privilege account who wins a race condition can gain SYSTEM privileges. Microsoft rates it Important (CVSS 7.0), not exploited, not publicly disclosed, 'Exploitation Less Likely'.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local","privilege-escalation","windows","windows-graphics-kernel"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":"Microsoft's entry (MSRC, CVE-2026-95950) says customer action is required but the retrievable data lists no affected builds or KB numbers. Open the Security Update Guide page for the CVE, find the row for your Windows version, and compare the KB with what is installed: run 'winver' or PowerShell 'Get-HotFix'. Confirm the November 2026 cumulative update (or later) is installed.","fix":null,"status":"open","published_at":"2026-11-10T19:21:47+00:00","first_seen_at":"2026-11-10T19:25:24+00:00","triaged_at":"2026-11-10T19:49:47+00:00","updated_at":"2026-11-10T20:21:54+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:49:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Graphics Kernel: out-of-bounds read lets a local user gain privileges","impact":"high","summary":"A flaw in the Windows Graphics Kernel lets an authorized local user read memory outside a buffer. An attacker with a low-privilege account can use it to elevate privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95950 for affected builds and the patch KB.","how_to_check":"- Check the installed Windows build with `winver` and compare it against the Microsoft security update guide entry for CVE-2026-95950\n- Confirm Windows Update has applied the latest cumulative updates","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Any Windows system where an authorized user can run code locally is potentially exposed, since the flaw is reached from a local session. The sources do not list affected Windows builds. Systems with no untrusted local users have lower practical risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":4494,"output_tokens":488,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95950 for affected builds and the patch KB.","search":"'-2026':16A,19A '-95950':17A,20A '2026':34B '7.0':72B 'account':57B 'allow':90C 'attack':51B,93C 'author':92C 'bound':7A,42B,84C 'condit':62B 'cve':15A,18A 'cvss':71B 'disclos':77B 'elev':95C 'escal':25B 'exploit':74B,78B 'fix':37B 'gain':13A,64B 'graphic':2A,29B,47B,88C 'import':70B 'infrastructur':21B 'kernel':3A,30B,48B,89C 'less':79B 'let':9A 'like':80B 'local':11A,22B,50B,97C 'low':55B 'low-privileg':54B 'microsoft':31B,67B 'novemb':33B 'out-of-bound':4A,39B,81C 'patch':35B 'privileg':14A,24B,56B,66B,96C 'privilege-escal':23B 'public':76B 'race':61B 'rate':68B 'read':8A,43B,85C 'system':65B 'tuesday':36B 'user':12A 'win':59B 'window':1A,26B,28B,46B,87C 'windows-graphics-kernel':27B","nicknames":[],"mitigations":[],"who_affected":"Windows systems where someone who is not fully trusted can run code locally (shared workstations, terminal/RDP servers, build or CI hosts, VDI) are the ones to prioritise. Microsoft's entry, as retrievable, does not list affected Windows versions or builds. Single-user machines with no untrusted local code have lower practical risk, since the flaw is local only (AV:L) and needs a race to be won (AC:H).","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","local","privilegeescalation","windows","windowsgraphicskernel"],"campaign_type":null,"search_a":"'-2026':16A,19A '-95950':17A,20A 'bound':7A 'cve':15A,18A 'gain':13A 'graphic':2A 'kernel':3A 'let':9A 'local':11A 'out-of-bound':4A 'privileg':14A 'read':8A 'user':12A 'window':1A","search_b":"'2026':34B '7.0':72B 'account':57B 'attack':51B 'bound':42B 'condit':62B 'cvss':71B 'disclos':77B 'escal':25B 'exploit':74B,78B 'fix':37B 'gain':64B 'graphic':29B,47B 'import':70B 'infrastructur':21B 'kernel':30B,48B 'less':79B 'like':80B 'local':22B,50B 'low':55B 'low-privileg':54B 'microsoft':31B,67B 'novemb':33B 'out-of-bound':39B 'patch':35B 'privileg':24B,56B,66B 'privilege-escal':23B 'public':76B 'race':61B 'rate':68B 'read':43B 'system':65B 'tuesday':36B 'win':59B 'window':26B,28B,46B 'windows-graphics-kernel':27B","search_c":"'allow':90C 'attack':93C 'author':92C 'bound':84C 'elev':95C 'graphic':88C 'kernel':89C 'local':97C 'out-of-bound':81C 'privileg':96C 'read':85C 'window':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95950","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95950","severity":null,"published_at":"2026-11-10T19:21:47+00:00","modified_at":"2026-11-10T19:21:47+00:00","first_seen_at":"2026-11-10T19:25:24+00:00","fetched_at":"2026-11-10T19:25:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95950:2645","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95950","severity":null,"published_at":"2026-11-10T20:21:54+00:00","modified_at":"2026-11-10T20:21:54+00:00","first_seen_at":"2026-11-10T20:21:54+00:00","fetched_at":"2026-11-10T20:21:54+00:00","note":"MSRC API record read: Important, EoP to SYSTEM, AC:H race, exploited No, disclosed No, Exploitation Less Likely. Product/build/KB table not in the data I could retrieve (JS-only page), so fix and products left unknown; nothing marked verified. Did not search posts: low-profile local EoP, no public discussion checked.","cites":["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95950"]}],"documents":[{"id":118011,"url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95950","title":"MSRC: CVE-2026-95950 Windows Graphics Kernel Elevation of Privilege Vulnerability","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}