{"id":"CVE-2026-95974","kind":"vulnerability","aliases":["CVE-2026-95974"],"related":[],"title":"Windows Graphics Kernel: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Graphics Kernel lets a user who already has an account on the machine run code with higher privileges. The sources give no further detail on the trigger or affected builds.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows","windows-server"],"not_affected_if":[],"how_to_check":"- Run `winver` and compare the build to the one Microsoft lists as fixed in its security update guide\n- Check Windows Update for pending cumulative updates","fix":null,"status":"open","published_at":"2026-11-10T19:21:53+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","triaged_at":"2026-11-10T19:49:42+00:00","updated_at":"2026-11-10T19:49:42+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:49:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Graphics Kernel: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Graphics Kernel lets a user who already has an account on the machine run code with higher privileges. The sources give no further detail on the trigger or affected builds.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level control of the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95974 for affected builds and the fixed update.","how_to_check":"- Run `winver` and compare the build to the one Microsoft lists as fixed in its security update guide\n- Check Windows Update for pending cumulative updates","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Any Windows machine with a local account that an attacker could log into or run code under is a candidate, since the flaw needs an authorized local user. The sources do not list affected Windows builds. Systems where only trusted administrators have accounts are lower risk but still need the update.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00069,"input_tokens":4498,"output_tokens":481,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95974 for affected builds and the fixed update.","search":"'-2026':14A,17A '-95974':15A,18A 'account':42B 'affect':61B 'allow':72C 'alreadi':39B 'attack':75C 'author':74C 'base':27B,65C 'buffer':28B,66C 'build':62B 'code':47B 'cve':13A,16A 'detail':56B 'elev':77C 'gain':10A 'give':53B 'graphic':2A,33B,70C 'heap':4A,26B,64C 'heap-bas':25B,63C 'higher':11A,49B 'infrastructur':19B 'kernel':3A,34B,71C 'let':6A,35B 'local':8A,79C 'machin':45B 'overflow':5A,29B,67C 'privileg':12A,50B,78C 'run':46B 'server':23B 'sourc':52B 'trigger':59B 'user':9A,37B 'window':1A,20B,22B,32B,69C 'windows-serv':21B","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine with a local account that an attacker could log into or run code under is a candidate, since the flaw needs an authorized local user. The sources do not list affected Windows builds. Systems where only trusted administrators have accounts are lower risk but still need the update.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows","windowsserver"],"campaign_type":null,"search_a":"'-2026':14A,17A '-95974':15A,18A 'cve':13A,16A 'gain':10A 'graphic':2A 'heap':4A 'higher':11A 'kernel':3A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'user':9A 'window':1A","search_b":"'account':42B 'affect':61B 'alreadi':39B 'base':27B 'buffer':28B 'build':62B 'code':47B 'detail':56B 'give':53B 'graphic':33B 'heap':26B 'heap-bas':25B 'higher':49B 'infrastructur':19B 'kernel':34B 'let':35B 'machin':45B 'overflow':29B 'privileg':50B 'run':46B 'server':23B 'sourc':52B 'trigger':59B 'user':37B 'window':20B,22B,32B 'windows-serv':21B","search_c":"'allow':72C 'attack':75C 'author':74C 'base':65C 'buffer':66C 'elev':77C 'graphic':70C 'heap':64C 'heap-bas':63C 'kernel':71C 'local':79C 'overflow':67C 'privileg':78C 'window':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95974","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95974","severity":null,"published_at":"2026-11-10T19:21:53+00:00","modified_at":"2026-11-10T19:21:54+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","fetched_at":"2026-11-10T19:25:25+00:00","note":null}],"documents":[{"id":117951,"url":"https://app.opencve.io/cve/CVE-2026-95974","title":"OpenCVE: CVE-2026-95974 (mirrors Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}