{"id":"CVE-2026-96122","kind":"vulnerability","aliases":["CVE-2026-96122"],"related":[],"title":"Windows Graphics Kernel: local flaw lets a logged-in user gain SYSTEM rights (Microsoft, Nov 2026)","description":"Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"Microsoft's November 2026 Patch Tuesday advisory (published 2026-11-10) describes an untrusted pointer dereference (CWE-822) in the Windows Graphics Kernel. An authorized local attacker can elevate privileges; Microsoft says successful exploitation could give SYSTEM. Rated Important, CVSS 7.8. Microsoft lists it as not publicly disclosed, not exploited, 'Exploitation Less Likely'; customer action required. Who is exposed: Windows machines where an attacker can already run code as a low-privilege user (shared workstations, RDP/terminal servers, Windows build hosts); it is local only, not remotely reachable. Single-user machines with no untrusted local code carry lower risk. Microsoft's data I could read does not list affected builds.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["graphics-kernel","infrastructure","local","privilege-escalation","windows"],"not_affected_if":["no-local-accounts","patched-with-nov-2026-update"],"how_to_check":"Run winver (or PowerShell: Get-ComputerInfo OsBuildNumber) and Get-HotFix, then compare with the November 2026 cumulative update listed for CVE-2026-96122 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96122 . The per-build list and KB numbers were not readable (page needs JavaScript), so they are unknown here.","fix":null,"status":"open","published_at":"2026-11-10T19:22:09+00:00","first_seen_at":"2026-11-10T19:25:31+00:00","triaged_at":"2026-11-10T19:36:29+00:00","updated_at":"2026-11-10T19:47:21+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:36:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Graphics Kernel: local pointer flaw lets a logged-in user gain admin rights","impact":"high","summary":"An untrusted pointer dereference in the Windows Graphics Kernel lets an authorized local user elevate their privileges. An attacker who already has a low-privilege account on the machine can gain higher system rights.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","graphics-kernel"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the machine","analyst_note":"Find the affected Windows builds and the Microsoft patch for CVE-2026-96122 in the Microsoft Security Update Guide.","how_to_check":"- Check the installed Windows build and compare it against Microsoft's security update guide for CVE-2026-96122 (unknown: the sources do not list affected builds)\n- Run `winver` to see the Windows version and build number","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-accounts"],"who_is_affected":"Any Windows machine with the Graphics Kernel component is in scope, since the flaw is in the kernel graphics code. The attacker must already be authorized on the system, so shared multi-user hosts and terminal servers carry the most risk. Single-user machines with no other local accounts are less exposed. The sources do not list affected builds.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4498,"output_tokens":545,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and the Microsoft patch for CVE-2026-96122 in the Microsoft Security Update Guide.","search":"'-10':43B '-11':42B '-2026':19A,22A '-822':50B '-96122':20A,23A '2026':17A,36B,41B '7.8':73B 'action':87B 'advisori':39B 'affect':142B 'allow':151C 'alreadi':98B 'attack':59B,96B,154C 'author':57B,153C 'build':112B,143B 'carri':130B 'code':100B,129B 'could':67B,137B 'custom':86B 'cve':18A,21A 'cvss':72B 'cwe':49B 'data':135B 'derefer':48B,146C 'describ':44B 'disclos':80B 'elev':61B,156C 'escal':31B 'exploit':66B,82B,83B 'expos':91B 'flaw':5A 'gain':12A 'give':68B 'graphic':2A,25B,54B,149C 'graphics-kernel':24B 'host':113B 'import':71B 'infrastructur':27B 'kernel':3A,26B,55B,150C 'less':84B 'let':6A 'like':85B 'list':75B,141B 'local':4A,28B,58B,116B,128B,158C 'log':9A 'logged-in':8A 'low':104B 'low-privileg':103B 'lower':131B 'machin':93B,124B 'microsoft':15A,33B,63B,74B,133B 'nov':16A 'novemb':35B 'patch':37B 'pointer':47B,145C 'privileg':30B,62B,105B,157C 'privilege-escal':29B 'public':79B 'publish':40B 'rate':70B 'rdp/terminal':109B 'reachabl':120B 'read':138B 'remot':119B 'requir':88B 'right':14A 'risk':132B 'run':99B 'say':64B 'server':110B 'share':107B 'singl':122B 'single-us':121B 'success':65B 'system':13A,69B 'tuesday':38B 'untrust':46B,127B,144C 'user':11A,106B,123B 'window':1A,32B,53B,92B,111B,148C 'workstat':108B","nicknames":[],"mitigations":[],"who_affected":"Any Windows machine with the Graphics Kernel component is in scope, since the flaw is in the kernel graphics code. The attacker must already be authorized on the system, so shared multi-user hosts and terminal servers carry the most risk. Single-user machines with no other local accounts are less exposed. The sources do not list affected builds.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["graphicskernel","high","infrastructure","local","privilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':19A,22A '-96122':20A,23A '2026':17A 'cve':18A,21A 'flaw':5A 'gain':12A 'graphic':2A 'kernel':3A 'let':6A 'local':4A 'log':9A 'logged-in':8A 'microsoft':15A 'nov':16A 'right':14A 'system':13A 'user':11A 'window':1A","search_b":"'-10':43B '-11':42B '-822':50B '2026':36B,41B '7.8':73B 'action':87B 'advisori':39B 'affect':142B 'alreadi':98B 'attack':59B,96B 'author':57B 'build':112B,143B 'carri':130B 'code':100B,129B 'could':67B,137B 'custom':86B 'cvss':72B 'cwe':49B 'data':135B 'derefer':48B 'describ':44B 'disclos':80B 'elev':61B 'escal':31B 'exploit':66B,82B,83B 'expos':91B 'give':68B 'graphic':25B,54B 'graphics-kernel':24B 'host':113B 'import':71B 'infrastructur':27B 'kernel':26B,55B 'less':84B 'like':85B 'list':75B,141B 'local':28B,58B,116B,128B 'low':104B 'low-privileg':103B 'lower':131B 'machin':93B,124B 'microsoft':33B,63B,74B,133B 'novemb':35B 'patch':37B 'pointer':47B 'privileg':30B,62B,105B 'privilege-escal':29B 'public':79B 'publish':40B 'rate':70B 'rdp/terminal':109B 'reachabl':120B 'read':138B 'remot':119B 'requir':88B 'risk':132B 'run':99B 'say':64B 'server':110B 'share':107B 'singl':122B 'single-us':121B 'success':65B 'system':69B 'tuesday':38B 'untrust':46B,127B 'user':106B,123B 'window':32B,53B,92B,111B 'workstat':108B","search_c":"'allow':151C 'attack':154C 'author':153C 'derefer':146C 'elev':156C 'graphic':149C 'kernel':150C 'local':158C 'pointer':145C 'privileg':157C 'untrust':144C 'window':148C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96122","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96122","severity":null,"published_at":"2026-11-10T19:22:09+00:00","modified_at":"2026-11-10T19:22:09+00:00","first_seen_at":"2026-11-10T19:25:31+00:00","fetched_at":"2026-11-10T19:25:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96122:2550","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-96122","severity":null,"published_at":"2026-11-10T19:47:21+00:00","modified_at":"2026-11-10T19:47:21+00:00","first_seen_at":"2026-11-10T19:47:21+00:00","fetched_at":"2026-11-10T19:47:21+00:00","note":"MSRC SUG API read (doc 117691): title, CWE-822, CVSS 7.8, Important, not exploited, not disclosed, customer action required. Affected builds and KB numbers not available (SUG page JS-only, affectedProduct API returned nothing); no fix verified, nothing marked verified. X not checked.","cites":["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-96122"]}],"documents":[{"id":117691,"url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-96122","title":"MSRC Security Update Guide: CVE-2026-96122 Windows Graphics Kernel Elevation of Privilege","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}