{"id":"CVE-2026-95966","kind":"vulnerability","aliases":["CVE-2026-95966"],"related":[],"title":"Windows Graphics Kernel: use-after-free lets a local user gain higher privileges","description":"Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"A use-after-free bug in the Windows Graphics Kernel lets an attacker who already has a local account elevate their privileges. The sources do not describe a remote trigger.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","kernel","privilege-escalation","use-after-free","windows"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":"Run winver (or PowerShell: [System.Environment]::OSVersion.Version) and compare the full build.revision with the fixed build for your version: you are exposed if it is lower. Fixed builds: Win10 1607/Server 2016 14393.9688; 1809/Server 2019 17763.9487; Win10 21H2 19044.7846; 22H2 19045.7846; Win11 23H2 22631.7711; 24H2 and 25H2 26100/26200.9974; 26H1 28000.3501; 26H2 26300.9974; Server 2022 20348.5870; Server 2025 26100.33822.","fix":"Install the November 2026 Windows cumulative update that brings the OS to at least the fixed build for your version (e.g. Win 11 24H2/25H2 10.0.26100/26200.9974, Win 10 22H2 10.0.19045.7846, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822). KB number unknown; confirm on the MSRC entry.","status":"open","published_at":"2026-11-10T19:21:53+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","triaged_at":"2026-11-10T19:49:46+00:00","updated_at":"2026-11-10T20:17:43+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:49:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Graphics Kernel: use-after-free lets a local user gain higher privileges","impact":"high","summary":"A use-after-free bug in the Windows Graphics Kernel lets an attacker who already has a local account elevate their privileges. The sources do not describe a remote trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","kernel"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-95966 for affected builds and the patch KB.","how_to_check":"- Run `winver` on Windows and compare the build with Microsoft's security update guide entry for CVE-2026-95966\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Windows machines with local, authenticated users are the exposed systems, since the attacker must already have a logon. The sources do not name the affected Windows builds or the patch. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":4484,"output_tokens":451,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-95966 for affected builds and the patch KB.","search":"'-2026':16A,19A '-95966':17A,20A '10':31A '11':22A,25A,28A '2016':44A '2019':41A '2022':38A '2025':35A '22h2':32A '23h2':29A '24h2':23A '25h2':26A 'account':74B 'allow':93C 'alreadi':70B 'attack':68B,96C 'author':95C 'bug':60B 'cve':15A,18A 'describ':82B 'elev':75B,98C 'escal':49B 'free':7A,53B,59B,88C 'gain':12A 'graphic':2A,64B,91C 'higher':13A 'infrastructur':45B 'kernel':3A,46B,65B,92C 'let':8A,66B 'local':10A,73B,100C 'privileg':14A,48B,77B,99C 'privilege-escal':47B 'remot':84B 'server':34A,37A,40A,43A 'sourc':79B 'trigger':85B 'use':5A,51B,57B,86C 'use-after-fre':4A,50B,56B 'user':11A 'window':1A,54B,63B,90C 'windows':21A,24A,27A,30A,33A,36A,39A,42A","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10, Windows 11 or Windows Server (2016, 2019, 2022, 2025) machine below the fixed build is affected, but the attacker must already have a local account, and exploitation is rated high-complexity. Shared systems such as terminal servers, VDI, build hosts and developer workstations matter most. Single-user machines with no untrusted code or users can patch on the normal schedule.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1022h2","1123h2","1124h2","1125h2","server2016","server2019","server2022","server2025","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windowsserver2016","windowsserver2019","windowsserver2022","windowsserver2025"],"ptokens":["10","11","2016","2019","2022","2025","22h2","23h2","24h2","25h2","server","windows"],"labels":["high","infrastructure","kernel","privilegeescalation","useafterfree","windows"],"campaign_type":null,"search_a":"'-2026':16A,19A '-95966':17A,20A '10':31A '11':22A,25A,28A '2016':44A '2019':41A '2022':38A '2025':35A '22h2':32A '23h2':29A '24h2':23A '25h2':26A 'cve':15A,18A 'free':7A 'gain':12A 'graphic':2A 'higher':13A 'kernel':3A 'let':8A 'local':10A 'privileg':14A 'server':34A,37A,40A,43A 'use':5A 'use-after-fre':4A 'user':11A 'window':1A 'windows':21A,24A,27A,30A,33A,36A,39A,42A","search_b":"'account':74B 'alreadi':70B 'attack':68B 'bug':60B 'describ':82B 'elev':75B 'escal':49B 'free':53B,59B 'graphic':64B 'infrastructur':45B 'kernel':46B,65B 'let':66B 'local':73B 'privileg':48B,77B 'privilege-escal':47B 'remot':84B 'sourc':79B 'trigger':85B 'use':51B,57B 'use-after-fre':50B,56B 'window':54B,63B","search_c":"'allow':93C 'attack':96C 'author':95C 'elev':98C 'free':88C 'graphic':91C 'kernel':92C 'local':100C 'privileg':99C 'use':86C 'window':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95966","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95966","severity":null,"published_at":"2026-11-10T19:21:53+00:00","modified_at":"2026-11-10T19:21:53+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","fetched_at":"2026-11-10T19:25:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95966:2636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95966","severity":null,"published_at":"2026-11-10T20:17:43+00:00","modified_at":"2026-11-10T20:17:43+00:00","first_seen_at":"2026-11-10T20:17:43+00:00","fetched_at":"2026-11-10T20:17:43+00:00","note":"MSRC page is JS-only and not readable here; affected builds and fixed build numbers taken from the Microsoft CNA data on the NVD page. KB numbers not found. Nothing marked verified. Search not used.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-95966"]}],"documents":[{"id":117998,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95966","title":"NVD CVE-2026-95966 (Microsoft CNA affected builds)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}