---
id: "CVE-2026-95950"
page: "https://infrastack.ai/live/CVE-2026-95950"
kind: "vulnerability"
aliases: ["CVE-2026-95950"]
title: "Windows Graphics Kernel: out-of-bounds read lets a local user gain privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "local", "privilege-escalation", "windows", "windows-graphics-kernel"]
not_affected_if: ["no-untrusted-local-users"]
published_at: "2026-11-10T19:21:47+00:00"
first_seen_at: "2026-11-10T19:25:24+00:00"
updated_at: "2026-11-10T20:21:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95950", "first_seen_at": "2026-11-10T19:25:24+00:00"}, {"source": "analyst", "url": "https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95950", "first_seen_at": "2026-11-10T20:21:54+00:00", "cites": ["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95950"]}]
exploit_sources: []
---

# Windows Graphics Kernel: out-of-bounds read lets a local user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-95950 (this .md is for agents)

Microsoft's November 2026 Patch Tuesday fixes an out-of-bounds read in the Windows Graphics Kernel. A local attacker with a low-privilege account who wins a race condition can gain SYSTEM privileges. Microsoft rates it Important (CVSS 7.0), not exploited, not publicly disclosed, 'Exploitation Less Likely'.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Microsoft's entry (MSRC, CVE-2026-95950) says customer action is required but the retrievable data lists no affected builds or KB numbers. Open the Security Update Guide page for the CVE, find the row for your Windows version, and compare the KB with what is installed: run 'winver' or PowerShell 'Get-HotFix'. Confirm the November 2026 cumulative update (or later) is installed.

## Timeline

- 2026-11-10T19:25:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95950
- 2026-11-10T20:21:54+00:00 analyst https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95950 — MSRC API record read: Important, EoP to SYSTEM, AC:H race, exploited No, disclosed No, Exploitation Less Likely. Product/build/KB table not in the data I could retrieve (JS-only page), so fix and products left unknown; nothing marked verified. Did not search posts: low-profile local EoP, no public discussion checked.

## Documents

- [advisory] MSRC: CVE-2026-95950 Windows Graphics Kernel Elevation of Privilege Vulnerability https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95950

## From the sources

Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_