Windows Advanced Rasterization Platform: Local privilege escalation (stack overflow)

Summary

A stack-based buffer overflow in the Windows Advanced Rasterization Platform (WARP), a software rasterizer in the DirectX graphics stack, allows an authorized local attacker to elevate privileges. The attacker needs an existing low-privilege foothold, such as a compromised account, a malicious application or access to a shared terminal server. The CVSS scope is changed, so the impact can extend beyond the vulnerable component.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
• Windows 10 Version 21H2: builds before 10.0.19044.7807
• Windows 10 Version 22H2: builds before 10.0.19045.7807
• Windows 11 Version 23H2: builds before 10.0.22631.7652
• Windows 11 Version 24H2: builds before 10.0.26100.9711
• Windows 11 Version 25H2 and 26H2: builds before 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 Version 26H1: builds before 10.0.28000.3231
• Windows Server 2022: builds before 10.0.20348.5761
• Windows Server 2025 (including Server Core): builds before 10.0.26100.33650
• Note: ranges come from the CVE record and a third-party source; verify them on MSRC.

Fixed in

• Fixed in the builds listed above, according to the CVE record.
• KB numbers for the November 2026 updates: Unknown.
• The fixed builds match October 2026 cumulative builds, so the release date must be verified on MSRC.

Workaround

Unknown.

• No vendor mitigation identified. Install the cumulative update.

Exploitation

• CVSS exploit maturity is Unproven (E:U). CISA SSVC lists exploitation as none and not automatable.
• No public proof of concept or in-the-wild exploitation was found. This is not confirmation.
• Recheck CISA KEV and vendor sources.

Our recommendation

• Install the November 2026 cumulative update on all affected Windows 10, Windows 11 and Windows Server systems, starting with multi-user servers and RDS/terminal servers.
• Verify the affected and fixed builds on the MSRC page before rollout, because the fix dates conflict.
• Restrict local logon and untrusted code on multi-user systems, and review low-privilege accounts.
• Batch-patch the whole Advanced Rasterization Platform component family, including the related CVE-2026-84019.
• Recheck the MSRC advisory and CISA KEV after the NVD analysis is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-105493 (CVE.org) www.cve.org
• Microsoft Security Update Guide CVE-2026-105493 msrc.microsoft.com
• DirectX WARP overview (Microsoft Learn) learn.microsoft.com
• November 2026 security update review (Zero Day Initiative) www.zerodayinitiative.com
• Strix CVE-2026-105493 (third-party aggregator) www.strix.ai
• Rapid7 record for related CVE-2026-84019 (Vulners) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 00:07.