{"id":"CVE-2026-96168","kind":"vulnerability","aliases":["CVE-2026-96168"],"related":[],"title":"Windows Graphics Kernel: pointer flaw lets a local user gain system privileges","description":"Untrusted pointer dereference in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.","summary":"An untrusted pointer dereference in the Windows Graphics Kernel lets a user who already has local access raise their privileges. The sources do not say which Windows builds are affected or what triggers the flaw.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Graphics Kernel","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["graphics-kernel","infrastructure","local","privilege-escalation","windows"],"not_affected_if":["patched"],"how_to_check":"Run winver or [System.Environment]::OSVersion in PowerShell and compare the build (10.0.<build>.<revision>) to the fixed builds in the product rows. Below the fixed build means exposed. Confirm on the Microsoft Security Update Guide page for CVE-2026-96168.","fix":"Install the November 2026 Windows cumulative update: Win10 1607/Server 2016 10.0.14393.9688, 1809/Server 2019 10.0.17763.9487, Win10 21H2/22H2 10.0.19044.7846 / 10.0.19045.7846, Win11 23H2 10.0.22631.7711, Win11 24H2/25H2 10.0.26100.9974 / 10.0.26200.9974, 26H1 10.0.28000.3501, 26H2 10.0.26300.9974, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822.","status":"open","published_at":"2026-11-10T19:22:13+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","triaged_at":"2026-11-10T19:48:07+00:00","updated_at":"2026-11-10T19:50:26+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:48:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Graphics Kernel: pointer flaw lets a local user gain system privileges","impact":"high","summary":"An untrusted pointer dereference in the Windows Graphics Kernel lets a user who already has local access raise their privileges. The sources do not say which Windows builds are affected or what triggers the flaw.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the machine","analyst_note":"Check the NVD entry and Microsoft's security update guide for CVE-2026-96168 to find affected Windows builds and the patch.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Graphics Kernel","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running Windows where a user already has a local account can be affected, since the attacker must be authorized on the machine first. The sources do not name affected Windows versions. unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":4498,"output_tokens":432,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Microsoft's security update guide for CVE-2026-96168 to find affected Windows builds and the patch.","search":"'-2026':14A,17A '-96168':15A,18A '10':23A,28A,33A,36A '11':39A,42A,45A,48A,51A '1607':24A '1809':29A '2016':26A '2019':31A '2022':55A '2025':58A '21h2':34A '22h2':37A '23h2':40A '24h2':43A '25h2':46A '26h1':49A '26h2':52A 'access':84B 'affect':97B 'allow':110C 'alreadi':81B 'attack':113C 'author':112C 'build':95B 'cve':13A,16A 'derefer':71B,105C 'elev':115C 'escal':66B 'flaw':5A,102B 'gain':10A 'graphic':2A,60B,75B,108C 'graphics':20A 'graphics-kernel':59B 'infrastructur':62B 'kernel':3A,21A,61B,76B,109C 'let':6A,77B 'local':8A,63B,83B,117C 'pointer':4A,70B,104C 'privileg':12A,65B,87B,116C 'privilege-escal':64B 'rais':85B 'say':92B 'server':25A,30A,54A,57A 'sourc':89B 'system':11A 'trigger':100B 'untrust':69B,103C 'user':9A,79B 'window':1A,67B,74B,94B,107C 'windows':19A,22A,27A,32A,35A,38A,41A,44A,47A,50A,53A,56A","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10, Windows 11 or Windows Server machine below the fixed build is affected. The attacker must already have a low-privilege local account, so the risk is highest on shared machines, terminal servers, VDI and build hosts. Fully patched machines can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","graphicskernel","server2022","server2025","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsgraphicskernel","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","graphics","kernel","server","windows"],"labels":["graphicskernel","high","infrastructure","local","privilegeescalation","vendor","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-96168':15A,18A '10':23A,28A,33A,36A '11':39A,42A,45A,48A,51A '1607':24A '1809':29A '2016':26A '2019':31A '2022':55A '2025':58A '21h2':34A '22h2':37A '23h2':40A '24h2':43A '25h2':46A '26h1':49A '26h2':52A 'cve':13A,16A 'flaw':5A 'gain':10A 'graphic':2A 'graphics':20A 'kernel':3A,21A 'let':6A 'local':8A 'pointer':4A 'privileg':12A 'server':25A,30A,54A,57A 'system':11A 'user':9A 'window':1A 'windows':19A,22A,27A,32A,35A,38A,41A,44A,47A,50A,53A,56A","search_b":"'access':84B 'affect':97B 'alreadi':81B 'build':95B 'derefer':71B 'escal':66B 'flaw':102B 'graphic':60B,75B 'graphics-kernel':59B 'infrastructur':62B 'kernel':61B,76B 'let':77B 'local':63B,83B 'pointer':70B 'privileg':65B,87B 'privilege-escal':64B 'rais':85B 'say':92B 'sourc':89B 'trigger':100B 'untrust':69B 'user':79B 'window':67B,74B,94B","search_c":"'allow':110C 'attack':113C 'author':112C 'derefer':105C 'elev':115C 'graphic':108C 'kernel':109C 'local':117C 'pointer':104C 'privileg':116C 'untrust':103C 'window':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96168","severity":null,"published_at":"2026-11-10T19:22:13+00:00","modified_at":"2026-11-10T19:22:16+00:00","first_seen_at":"2026-11-10T19:25:32+00:00","fetched_at":"2026-11-10T19:25:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96168:2564","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96168","severity":null,"published_at":"2026-11-10T19:50:26+00:00","modified_at":"2026-11-10T19:50:26+00:00","first_seen_at":"2026-11-10T19:50:26+00:00","fetched_at":"2026-11-10T19:50:26+00:00","note":"NVD page relays Microsoft CNA affected builds; MSRC page is JS-only and unreadable, so nothing marked verified. No exploitation or PoC seen.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-96168"]}],"documents":[{"id":117701,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96168","title":"NVD CVE-2026-96168 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}