Windows Graphics Kernel: local flaw lets a logged-in user gain SYSTEM rights (Microsoft, Nov 2026)

Microsoft's November 2026 Patch Tuesday advisory (published 2026-11-10) describes an untrusted pointer dereference (CWE-822) in the Windows Graphics Kernel. An authorized local attacker can elevate privileges; Microsoft says successful exploitation could give SYSTEM. Rated Important, CVSS 7.8. Microsoft lists it as not publicly disclosed, not exploited, 'Exploitation Less Likely'; customer action required. Who is exposed: Windows machines where an attacker can already run code as a low-privilege user (shared workstations, RDP/terminal servers, Windows build hosts); it is local only, not remotely reachable. Single-user machines with no untrusted local code carry lower risk. Microsoft's data I could read does not list affected builds.