Windows Advanced Rasterization Platform: Heap-based buffer overflow

Summary

A heap-based buffer overflow in the Windows Advanced Rasterization Platform (WARP) allows an authorized local attacker to elevate privileges. The attacker needs a valid local account and must already have a foothold on the system. The CVSS score is 8.8 (High), with a scope change and high impact on confidentiality, integrity and availability.

Affected

• Windows 10 Version 1809 (before 10.0.17763.9376)
• Windows 10 Version 21H2 (before 10.0.19044.7807)
• Windows 10 Version 22H2 (before 10.0.19045.7807)
• Windows 11 Version 23H2 (before 10.0.22631.7652)
• Windows 11 Version 24H2, 25H2, 26H1 and 26H2 (listed in the CVE record, build ranges see MSRC)
• Windows Server 2019 and Server 2025 (listed in the CVE record, build ranges see MSRC)
• Windows Server 2022 (listed in the CVE record, build ranges see MSRC)
• Server 2019, 2022 and 2025 build limits from a secondary source are not confirmed by Microsoft

Fixed in

• Patched builds implied by the CVE record: 10.0.17763.9376 (1809, Server 2019), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2)
• Other listed branches: verify the exact fixed builds in the MSRC advisory
• Install the latest cumulative update for each branch

Workaround

• Unknown. Microsoft has not published a workaround in the sources reviewed.
• General hardening, not a vendor fix: restrict standard users from running untrusted code and limit local logon to trusted users.

Exploitation

• No evidence of exploitation in the wild or public proof of concept found at the time of research.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.

Our recommendation

• Check the MSRC advisory and apply the latest cumulative update to all affected Windows 10, Windows 11 and Windows Server systems in the next regular patch cycle.
• Verify each CVE ID of the same publication batch separately against MSRC.
• Review local accounts and restrict local logon to trusted users.
• Monitor for unusual privilege escalation or unexpected code execution on endpoints and servers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org record CVE-2026-105021 www.cve.org
• Microsoft Security Response Center advisory CVE-2026-105021 msrc.microsoft.com
• Strix CVE-2026-105021 (secondary source, unconfirmed) www.strix.ai
• Wikipedia: Windows Advanced Rasterization Platform en.wikipedia.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 00:11.