Windows Advanced Rasterization Platform: Local privilege escalation via heap overflow
Summary
A heap-based buffer overflow in the Windows Advanced Rasterization Platform (WARP) allows an authorized local user to elevate privileges. Successful exploitation can lead to SYSTEM-level control with high impact on confidentiality, integrity and availability. The attacker needs valid low-privileged access to the system, but no user interaction. CISA SSVC rates exploitation as none and automatable as no.
Affected
- Windows 10 Version 1809: 10.0.17763.0 before 10.0.17763.9376
- Windows 10 Version 21H2: 10.0.19044.0 before 10.0.19044.7807
- Windows 10 Version 22H2: 10.0.19045.0 before 10.0.19045.7807
- Windows 11 Version 23H2: 10.0.22631.0 before 10.0.22631.7652
- Windows 11 Version 24H2: 10.0.26100.0 before 10.0.26100.9711
- Windows 11 Version 25H2: 10.0.26200.0 before 10.0.26200.9711
- Windows 11 Version 26H1: 10.0.28000.0 before 10.0.28000.3231
- Windows 11 Version 26H2: 10.0.26300.0 before 10.0.26300.9711
- Windows Server 2019 incl. Server Core: 10.0.17763.0 before 10.0.17763.9376
- Windows Server 2022: 10.0.20348.0 before 10.0.20348.5761
- Windows Server 2025 incl. Server Core: 10.0.26100.0 before 10.0.26100.33650
Note: The CVE record lists these builds. The research notes could not confirm the 23H2 to 26H2 and server entries against MSRC, so verify them there.
Fixed in
- Fixed in the builds listed above (first fixed build per branch).
- November 10, 2026 cumulative updates (secondary sources): Windows 10 21H2 and 22H2: KB5131096 (19044.7846 and 19045.7846, via ESU); Windows 11 23H2: KB5131087 (22631.7711); Windows 11 24H2, 25H2 and 26H2: KB5132061; Windows 10 1809: KB number unknown.
- The mapping of these KBs to this CVE is not confirmed.
Workaround
Unknown.
- No vendor-published workaround found. Install the update.
Exploitation
- No known exploitation. CISA SSVC: exploitation none. CVE record exploit maturity: unproven.
- No public proof of concept found.
- Treat as not known to be exploited, not as not exploitable.
Our recommendation
- Install the November 2026 cumulative update on all affected systems, prioritising terminal servers, RDS hosts and workstations with many local users.
- Enrol Windows 10 21H2, 22H2 and 1809 systems in ESU to receive the fix.
- Verify build numbers and the KB mapping against the MSRC Update Guide.
- Restrict local logon rights and monitor for unusual privilege escalation.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Advanced Rasterization Platform
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126657, KB5126655, KB5126653, KB5127648, KB5126646
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE.org record www.cve.org
- MSRC Security Update Guide msrc.microsoft.com
- Strix CVE summary www.strix.ai
- Tenable: November 2026 Patch Tuesday www.tenable.com
- BleepingComputer: Windows 11 November 2026 updates www.bleepingcomputer.com
- Windows Report: Windows 10 KB5131096 windowsreport.com
- Windows Report: Windows 11 November 2026 updates windowsreport.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:16.
Original description (NVD)
Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.