Windows Advanced Rasterization Platform: Heap overflow, local privilege escalation

Summary

A heap-based buffer overflow in the Windows Advanced Rasterization Platform component allows an authorized local user to elevate privileges. The attacker needs a low-privileged account on the system and no user interaction. The vulnerability is not directly reachable from the internet, but it can be used after an initial foothold, for example through phishing or malware running in a user session.

Affected

• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9376
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33650

Fixed in

• Install the Microsoft security update for the affected Windows build (first fixed builds are listed as "before" values under Affected; KB numbers unverified).
• Check the MSRC advisory for the exact update packages: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105497

Workaround

Unknown. No mitigation was found in the sources. Patching is the remedy.

Exploitation

• Microsoft's CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• No public reports of exploitation in the wild and no public proof of concept were found.
• CISA KEV status was not checked.

Our recommendation

• Patch affected Windows 10, 11 and Server systems in the next update cycle, and prioritize Remote Desktop/terminal servers and shared PCs.
• Install the whole batch of related Advanced Rasterization Platform fixes together, not only this CVE.
• Systems on Windows 10 1809, 21H2 and 22H2 should be upgraded or enrolled in Extended Security Updates, as these builds are at or near end of support.
• Monitor for unusual local privilege escalation activity on multi-user systems.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105497 msrc.microsoft.com
• CVE Record CVE-2026-105497 (CVE Program) www.cve.org
• Strix: CVE-2026-105497 www.strix.ai
• VulDB: related entry 434538 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 00:04.