Microsoft Windows Advanced Rasterization Platform: Heap-based buffer overflow

Summary

A heap-based buffer overflow in the Windows Advanced Rasterization Platform component of Microsoft Windows allows an authorized local attacker to elevate privileges. The CVE record also lists CWE-125 (out-of-bounds read). The attacker needs a low-privileged account on the affected system, so the flaw matters once a user account is compromised, for example through phishing or malicious files. A successful exploit can give full control over the host, because the scope is changed and confidentiality, integrity and availability are all rated high.

Affected

• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2019 and Server Core installation (10.0.17763.0 to before 10.0.17763.9376)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5761)
• Windows Server 2025 and Server Core installation (10.0.26100.0 to before 10.0.26100.33650)

Fixed in

• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.9711
• Windows Server 2019: 10.0.17763.9376
• Windows Server 2022: 10.0.20348.5761
• Windows Server 2025: 10.0.26100.33650

KB article numbers: Unknown.

Workaround

Unknown. No workaround has been identified. Install the security update for the affected build.

Exploitation

• The CVSS vector rates exploit maturity as unproven (E:U), so Microsoft reports no known exploitation.
• No entry in the CISA KEV catalog at the time of research.
• Public proof-of-concept code: Unknown.

Our recommendation

• Install the November 2026 security update on all affected Windows 10, 11 and Server systems.
• Check the installed build number against the fixed-build list and confirm the Windows Server entries in the MSRC advisory.
• Limit local logon and restrict untrusted files and browser downloads, since an attacker first needs a low-privileged account.
• Monitor for exploitation and re-check the entry once NVD and MSRC complete their analysis.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-105498 msrc.microsoft.com
• CVE Record CVE-2026-105498 www.cve.org
• Strix AI: CVE-2026-105498 (third-party aggregator) www.strix.ai
• CISA: Reducing significant risk from known exploited vulnerabilities www.cisa.gov

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 00:05.