Microsoft Windows: Heap-based buffer overflow in Advanced Rasterization Platform

Summary

A heap-based buffer overflow in the Windows Advanced Rasterization Platform allows a locally authorized attacker to elevate privileges. Exploitation requires an existing local, low-privileged foothold, such as a compromised user or service account. The CVSS score is 8.8 (High), with a scope change, so a successful attack could affect resources beyond the vulnerable component.

Affected

• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9376
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33650

Fixed in

• Fixed in the Microsoft security update for the affected builds listed above (Windows 10/11 and Server).
• Exact fixed builds for Windows Server and some Windows 11 lines are secondary-source data and must be confirmed in the MSRC advisory.
• KB numbers: Unknown.

Workaround

Unknown.

Exploitation

• Not known to be exploited in the wild.
• No public proof of concept known.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Prioritise the Microsoft security update on all affected Windows 10, 11 and Server systems, starting with multi-user systems, terminal servers and RDS hosts.
• Verify the fixed build numbers in the MSRC advisory before rollout.
• Review local accounts and privileges, and monitor endpoints for privilege escalation.
• Re-check MSRC and CISA KEV for changes, since the CVE was published recently.
• Unknown mitigation status: apply the update as the primary measure.
• No action needed for systems outside the affected versions.
• Note: not verified by the MSRC page in this assessment.
• Check exposure of Windows 10 21H2 and 22H2 systems, which are still common in SMEs.
• Keep backups and incident response contacts ready.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record (CVE.org) www.cve.org
• Microsoft Security Update Guide (MSRC) msrc.microsoft.com
• VulDB vuldb.com
• Strix aggregator (secondary) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 00:03.