Microsoft Windows Graphics Kernel: Use-after-free leads to privilege escalation

Summary

A use-after-free flaw (CWE-416) in the Windows Graphics Kernel allows an attacker who already has a local, low-privileged account to elevate privileges to a higher level. The attack is local only, not internet-facing, and needs an existing foothold such as a phished or weak account. Windows 10 Version 1607 and Windows Server 2016 are at or near end of support, so this flaw may not be fixed later.

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 to below 10.0.14393.9612)
• Windows Server 2016 (builds 10.0.14393.0 to below 10.0.14393.9612)
• Other Windows 10, Windows 11 and Windows Server 2012/2012 R2 builds are also listed in the CNA record (see sources)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 (KB5126868, not explicitly confirmed in the MSRC CVE table)
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2 and 22H2: 10.0.19044.7807 and 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2, 25H2 and 26H2: 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows Server 2012 and 2012 R2: 6.2.9200.26434 and 6.3.9600.23470

Workaround

Unknown.

Exploitation

• No public proof of concept known.
• Not known to be exploited in the wild.
• Not listed in CISA KEV according to a third-party alert (not verified directly).
• EPSS 0.25% at the time of the alert.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Inventory all devices and servers running Windows 10 1607 or Windows Server 2016.
• Install KB5126868 or a later cumulative update on systems that are still eligible for updates.
• Confirm update eligibility or Extended Security Updates with Microsoft before planning, as the release-health page reports end of updates for LTSB 2016.
• Limit local accounts and remove unneeded local logons on unpatched systems.
• Plan migration away from these end-of-support versions.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-102194 msrc.microsoft.com
• KB5126868 Windows 10 1607 security update (October 2026) support.microsoft.com
• Windows 10 1607 and Windows Server 2016 release health status learn.microsoft.com
• NVD mirror: CVE-2026-102194 vulners.com
• Third-party watchlist alert (KEV and EPSS) github.com
• KB5134123 Windows 10 1607 update (out-of-band, non-security) support.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:54.