{"id":"CVE-2026-95983","kind":"vulnerability","aliases":["CVE-2026-95983"],"related":[],"title":"Windows Graphics Kernel: pointer flaw lets a local user gain admin rights","description":"Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"An untrusted pointer dereference in the Windows Graphics Kernel lets an attacker who already has a local account raise their privileges. Successful exploitation gives the attacker higher-level control of the Windows machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1809","fixed":["10.0.17763.9487"],"affected":">= 10.0.17763.0, < 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":">= 10.0.19044.0, < 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">= 10.0.19045.0, < 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">= 10.0.22631.0, < 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":">= 10.0.26100.0, < 10.0.26100.9974","ecosystem":"microsoft"}],"ecosystems":[],"tags":["graphics-kernel","infrastructure","local-privilege-escalation","windows"],"not_affected_if":["patched-november-2026"],"how_to_check":"Run winver or [System.Environment]::OSVersion / 'cmd /c ver' and compare the full build (e.g. 10.0.19045.xxxx) to the fixed build for your Windows version. Lower than the fixed build means exposed. Server 2019/2022/2025 and Win11 25H2/26H1/26H2 are listed as affected by Check Point, with fixed builds unknown until the MSRC page is read.","fix":"Install the November 2026 Windows cumulative update. Build numbers reported by OffSeq from the CVE record: Win10 1809 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974. Builds for Server, Win11 25H2/26H1/26H2 not confirmed.","status":"open","published_at":"2026-11-10T19:21:54+00:00","first_seen_at":"2026-11-10T19:25:26+00:00","triaged_at":"2026-11-10T19:38:04+00:00","updated_at":"2026-11-10T20:14:46+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Graphics Kernel: pointer flaw lets a local user gain admin rights","impact":"high","summary":"An untrusted pointer dereference in the Windows Graphics Kernel lets an attacker who already has a local account raise their privileges. Successful exploitation gives the attacker higher-level control of the Windows machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","graphics-kernel"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the Windows machine","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-95983 for affected builds and the patch version.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Machines running affected Windows builds where a user with a local account can run code. Remote-only exposure is not described by the sources. unknown for exact builds.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":4498,"output_tokens":401,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-95983 for affected builds and the patch version.","search":"'-2026':14A,17A '-95983':15A,18A '10':20A,23A,26A '11':29A,32A '1809':21A '21h2':24A '22h2':27A '23h2':30A '24h2':33A 'account':60B 'admin':11A 'allow':84C 'alreadi':56B 'attack':54B,68B,87C 'author':86C 'control':72B 'cve':13A,16A 'derefer':46B,79C 'elev':89C 'escal':41B 'exploit':65B 'flaw':5A 'gain':10A 'give':66B 'graphic':2A,35B,50B,82C 'graphics-kernel':34B 'higher':70B 'higher-level':69B 'infrastructur':37B 'kernel':3A,36B,51B,83C 'let':6A,52B 'level':71B 'local':8A,39B,59B,91C 'local-privilege-escal':38B 'machin':76B 'pointer':4A,45B,78C 'privileg':40B,63B,90C 'rais':61B 'right':12A 'success':64B 'untrust':44B,77C 'user':9A 'window':1A,42B,49B,75B,81C 'windows':19A,22A,25A,28A,31A","nicknames":[],"mitigations":[],"who_affected":"Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, and per Check Point 25H2, 26H1, 26H2) and Windows Server 2019, 2022 and 2025 that have not installed the November 2026 update. An attacker needs a local low-privilege account or code execution already; this is a privilege escalation, not remote. Most relevant to shared machines, RDS/terminal servers, CI runners and any host where untrusted users or code run.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101809","1021h2","1022h2","1123h2","1124h2","windows101809","windows1021h2","windows1022h2","windows1123h2","windows1124h2"],"ptokens":["10","11","1809","21h2","22h2","23h2","24h2","windows"],"labels":["graphicskernel","high","infrastructure","localprivilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-95983':15A,18A '10':20A,23A,26A '11':29A,32A '1809':21A '21h2':24A '22h2':27A '23h2':30A '24h2':33A 'admin':11A 'cve':13A,16A 'flaw':5A 'gain':10A 'graphic':2A 'kernel':3A 'let':6A 'local':8A 'pointer':4A 'right':12A 'user':9A 'window':1A 'windows':19A,22A,25A,28A,31A","search_b":"'account':60B 'alreadi':56B 'attack':54B,68B 'control':72B 'derefer':46B 'escal':41B 'exploit':65B 'give':66B 'graphic':35B,50B 'graphics-kernel':34B 'higher':70B 'higher-level':69B 'infrastructur':37B 'kernel':36B,51B 'let':52B 'level':71B 'local':39B,59B 'local-privilege-escal':38B 'machin':76B 'pointer':45B 'privileg':40B,63B 'rais':61B 'success':64B 'untrust':44B 'window':42B,49B,75B","search_c":"'allow':84C 'attack':87C 'author':86C 'derefer':79C 'elev':89C 'graphic':82C 'kernel':83C 'local':91C 'pointer':78C 'privileg':90C 'untrust':77C 'window':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95983","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95983","severity":null,"published_at":"2026-11-10T19:21:54+00:00","modified_at":"2026-11-10T19:21:55+00:00","first_seen_at":"2026-11-10T19:25:26+00:00","fetched_at":"2026-11-10T19:25:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95983:2628","url":"https://radar.offseq.com/threat/cve-2026-95983-cwe-822-untrusted-pointer-dereference-in-microsoft-windows-10-version-1809-72cc17e36bcd980d","severity":null,"published_at":"2026-11-10T20:14:46+00:00","modified_at":"2026-11-10T20:14:46+00:00","first_seen_at":"2026-11-10T20:14:46+00:00","fetched_at":"2026-11-10T20:14:46+00:00","note":"MSRC page and NVD not retrievable via tools; versions from OffSeq (CVE record data) and affected list from Check Point. Nothing verified because no vendor page was read. Not exploited per OffSeq, no PoC found. Revisit to read MSRC for Server and 25H2/26H x fixed builds.","cites":["https://radar.offseq.com/threat/cve-2026-95983-cwe-822-untrusted-pointer-dereference-in-microsoft-windows-10-version-1809-72cc17e36bcd980d","https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-17417.html/"]}],"documents":[{"id":117809,"url":"https://radar.offseq.com/threat/cve-2026-95983-cwe-822-untrusted-pointer-dereference-in-microsoft-windows-10-version-1809-72cc17e36bcd980d","title":"OffSeq: CVE-2026-95983 affected builds and fixed versions","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":117810,"url":"https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-17417.html/","title":"Check Point CPAI-2026-17417: affected Windows list","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}