Windows Advanced Rasterization Platform: Heap-based buffer overflow

Summary

A heap-based buffer overflow in the Windows Advanced Rasterization Platform (WARP), a software fallback renderer built into Windows, allows an attacker with low privileges to elevate privileges locally to a higher level, with a CVSS 3.1 score of 8.8. The attacker needs a valid local account or code already running on the host, and no user interaction is required. The vulnerability is not remotely exploitable, but it is relevant on multi-user systems such as terminal servers and shared workstations.

Affected

• Microsoft Windows 10 Version 1809 (builds before 10.0.17763.9376)
• Microsoft Windows 10 Version 21H2 (builds before 10.0.19044.7807)
• Microsoft Windows 10 Version 22H2 (builds before 10.0.19045.7807)
• Microsoft Windows 11 Version 23H2 (builds before 10.0.22631.7652)
• Microsoft Windows 11 Version 24H2 (builds before 10.0.26100.9711)
• Microsoft Windows 11 Version 25H2 (builds before 10.0.26200.9711)
• Microsoft Windows 11 Version 26H1 (builds before 10.0.28000.3231)
• Microsoft Windows 11 Version 26H2 (builds before 10.0.26300.9711)
• Microsoft Windows Server 2019, including Server Core (builds before 10.0.17763.9376)
• Microsoft Windows Server 2022 (builds before 10.0.20348.5761)
• Microsoft Windows Server 2025, including Server Core (builds before 10.0.26100.33650)

Fixed in

Install the November 2026 security update for the affected Windows version. The fixed builds are listed above. Verify the exact KB numbers in the MSRC Security Updates table, because the KB mapping could not be confirmed.

Workaround

Unknown. No workaround has been identified. Install the update.

Exploitation

• Exploited in the wild: no evidence found.
• Public proof-of-concept exploit: none found.
• Microsoft's exploit code maturity rating is Unproven (E:U).
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• Listing in the CISA Known Exploited Vulnerabilities catalogue: not verified.

Our recommendation

• Install the November 2026 Windows security update on all affected systems, prioritising Remote Desktop and terminal servers, shared workstations and Windows Server 2019, 2022 and 2025 hosts.
• Check the MSRC page for the exact fixed builds and KB numbers.
• Apply the whole WARP update batch from the same Patch Tuesday together.
• Limit local logon rights on multi-user systems and monitor for unexpected SYSTEM-level processes.
• Re-check the NVD and CISA KEV status, because the NVD entry was still awaiting analysis at the time of research.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-105491 msrc.microsoft.com
• CVE Record CVE-2026-105491 (CVE Program) www.cve.org
• Strix AI: CVE-2026-105491 (version list, not confirmed) www.strix.ai
• ZDI: The November 2026 Security Update Review www.zerodayinitiative.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 00:06.