Windows 11 26H1: Heap-based buffer overflow in Microsoft Graphics Component
Summary
A heap-based buffer overflow in the Microsoft Graphics Component of Windows 11 version 26H1 allows an authorized local attacker to elevate privileges. The attacker needs a low-privileged account or code running on the device, and exploitation is rated as high complexity. If exploited, the impact on confidentiality, integrity and availability is rated high. Other Windows 11 versions are not in the listed affected range.
Affected
- Microsoft Windows 11 version 26H1 (ARM64-based and x64-based systems)
- Builds 10.0.28000.0 up to but not including 10.0.28000.3231
Fixed in
- Build 10.0.28000.3231 or later, delivered by the October 13, 2026 update KB5127646 (OS build 28000.3231), according to KB feed entries. Confirm in the MSRC advisory.
Workaround
Unknown. No workaround found; applying the update is the remedy.
Exploitation
- Exploited in the wild: unconfirmed.
- Public proof of concept: unknown.
- EPSS about 0.28%, which is low.
- CISA KEV status: unconfirmed. A Tenable plugin lists the CVE with an exploit-available flag and a KEV due date of 16 Oct 2026, but these flags cover the plugin as a whole and may not apply to this CVE.
Our recommendation
- Check whether any devices run Windows 11 26H1 (inventory of OS build numbers).
- Install the October 2026 update so that the build is 10.0.28000.3231 or later.
- Prioritise the update if KEV status is confirmed.
- Verify the details in the MSRC advisory before client communication.
- Limit local user accounts and monitor for suspicious privilege escalation.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Microsoft Graphics Component
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows
- Updates (KB)
- KB5127646
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide (MSRC) msrc.microsoft.com
- Vulners CVE list record (CNA data) vulners.com
- Vulners NVD record vulners.com
- PT-2026-111919 (KB feed entry) vulners.com
- Tenable plugin 365469 www.tenable.com
- Strix CVE record www.strix.ai
- Windows 11 (Wikipedia) en.wikipedia.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:53.
Original description (NVD)
Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.