Windows GDI: Out-of-bounds read allows local privilege escalation

Summary

An out-of-bounds read (CWE-125) in the Windows GDI graphics subsystem allows an attacker with local access and low privileges to elevate privileges to SYSTEM. Successful exploitation would give high impact to confidentiality, integrity and availability. The attacker needs a foothold on the system first, for example via phishing, a compromised local account or malware.

Affected

• Windows 10 Version 1607 (Server 2016 also affected): builds from 10.0.14393.0 before 10.0.14393.9688
• Windows 10 Version 1809 (Server 2019 also affected): builds from 10.0.17763.0 before 10.0.17763.9487
• Windows 10 Version 21H2: builds from 10.0.19044.0 before 10.0.19045.7846 (see note: 10.0.19044.7846)
• Windows 10 Version 22H2: builds from 10.0.19045.0 before 10.0.19045.7846
• Windows 11 Version 23H2: builds from 10.0.22631.0 before 10.0.22631.7711
• Windows 11 Version 24H2: builds from 10.0.26100.0 before 10.0.26100.9974
• Windows 11 Version 25H2: builds from 10.0.26200.0 before 10.0.26200.9974
• Windows 11 Version 26H1: builds from 10.0.28000.0 before 10.0.28000.3501
• Windows 11 Version 26H2: builds from 10.0.26300.0 before 10.0.26300.9974
• Windows Server 2022: builds from 10.0.20348.0 before 10.0.20348.5870

Fixed in

• Builds at or above the fixed values listed for each affected Windows version (for example 10.0.22631.7711 for Windows 11 23H2, 10.0.20348.5870 for Server 2022).
• Confirm the exact KB and build numbers for your version on the MSRC Security Update Guide.

Workaround

Unknown. No documented workaround was found; apply the Windows security update.

Exploitation

• CISA SSVC: exploitation none, not automatable, total technical impact.
• No evidence of exploitation in the wild for this CVE.
• No public proof-of-concept found.
• Some vendor-related reports mention one exploited bug in the November 2026 release, but none of the sources tie it to this CVE.

Our recommendation

• Patch in the regular November 2026 update cycle, starting with Windows 10 and Server systems that are out of support or have no Extended Security Updates.
• Check each Windows build against the affected ranges above and verify the fixed build on MSRC.
• Limit local logon on shared, multi-user, RDS and terminal servers, and monitor for unusual privilege changes.
• No emergency action is indicated based on current exploitation data.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org record CVE-2026-108407 www.cve.org
• MSRC Security Update Guide msrc.microsoft.com
• Senserva KB 5131096 senserva.com
• strix.ai CVE-2026-108407 mirror www.strix.ai
• ZDI November 2026 security update review www.zerodayinitiative.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:27.