Windows Advanced Rasterization Platform: Local privilege escalation

Summary

A double free vulnerability (CWE-415) in the Windows Advanced Rasterization Platform (WARP), Microsoft's software graphics renderer, allows an authorized local user to elevate privileges. The attacker needs a valid low-privilege local account and must run code on the system first, so this is a second-stage risk rather than an entry point. The CVSS score is 7.8 (High), with a scope change and high impact on confidentiality, integrity and availability.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
• Windows 10 Version 21H2: builds before 10.0.19044.7807
• Windows 10 Version 22H2: builds before 10.0.19045.7807
• Windows 11 Version 23H2: builds before 10.0.22631.7652
• Windows 11 Version 24H2: builds before 10.0.26100.9711
• Windows 11 Version 25H2: builds before 10.0.26200.9711
• Windows 11 Version 26H1: builds before 10.0.28000.3231
• Windows 11 Version 26H2: builds before 10.0.26300.9711
• Windows Server 2022: builds before 10.0.20348.5761 (provisional, to be confirmed on MSRC)
• Windows Server 2025 (including Server Core): builds before 10.0.26100.33650

Fixed in

• Fixed in the Windows security updates of November 2026. The fixed build is the first build after each affected range listed above.
• Confirm the exact KB article per product on the MSRC advisory before rollout.

Workaround

Unknown. No vendor-documented workaround is available. Patching is the fix.

Exploitation

• No known exploitation as of 11 Nov 2026. Rapid7 rates exploitation as less likely and lists the issue as not publicly disclosed.
• CVSS exploit code maturity is unproven (E:U). No public proof of concept was found, and no CISA KEV entry was found.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Install the November 2026 Windows security updates with the normal patch cycle, starting with terminal servers and shared endpoints.
• Prioritize Windows 10 systems on Extended Security Updates and Windows 11 23H2 Enterprise/Education devices, which must move to 25H2.
• Patch the whole November 2026 WARP batch, not only this CVE.
• Re-check CISA KEV and the MSRC advisory for changes before closing this item.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105025 msrc.microsoft.com
• CVE Record: CVE-2026-105025 www.cve.org
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Microsoft Windows message center (release health) learn.microsoft.com
• Pureinfotech: Microsoft November 2026 update pureinfotech.com
• Strix AI: CVE-2026-105025 (third-party, provisional) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:40.