Windows Advanced Rasterization Platform: Elevation of privilege
Summary
Microsoft Windows includes the Windows Advanced Rasterization Platform (WARP), a software graphics rendering component that loads functionality from an untrusted control sphere. An authorized local attacker with low privileges can exploit this to elevate privileges, with a changed scope and high impact on confidentiality, integrity and availability. Exploitation requires prior access to the system, so the flaw is not directly reachable from the internet. CVSS 8.8.
Affected
- Windows 10 Version 1809 and Windows Server 2019 (including Server Core): before 10.0.17763.9376
- Windows 10 Version 21H2: before 10.0.19044.7807
- Windows 10 Version 22H2: before 10.0.19045.7807
- Windows 11 Version 23H2: before 10.0.22631.7652
- Windows 11 Version 24H2: before 10.0.26100.9711
- Windows 11 Version 25H2: before 10.0.26200.9711
- Windows 11 Version 26H1: before 10.0.28000.3231
- Windows 11 Version 26H2: before 10.0.26300.9711
- Windows Server 2022: before 10.0.20348.5761
- Windows Server 2025 (including Server Core): before 10.0.26100.33650
Fixed in
- Install the November 2026 security update for each affected edition. The fixed builds are listed under Affected.
- Confirm the exact KB article for each edition on the MSRC advisory.
Workaround
Unknown.
Exploitation
- No known exploitation at publication. CISA SSVC lists exploitation as none and automatable as no.
- The CVSS vector uses E:U (exploit code maturity: unproven).
- No public proof-of-concept found.
Our recommendation
- Read the MSRC advisory and confirm the fixed build for each Windows edition in use.
- Deploy the November 2026 cumulative update to all affected Windows clients and servers, and patch related WARP elevation of privilege CVEs in the same cycle.
- Prioritise multi-user systems, terminal servers and shared workstations.
- Reduce local escalation risk with least privilege, application control and timely patching of browsers and Office.
- Watch the NVD entry and CISA's KEV catalogue for changes.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Advanced Rasterization Platform
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126657, KB5126655, KB5126653, KB5127648, KB5126646
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-118225 msrc.microsoft.com
- CVE Record CVE-2026-118225 www.cve.org
- Strix: CVE-2026-118225 www.strix.ai
- BleepingComputer: Windows 10 KB5131096 Extended Security Update www.bleepingcomputer.com
- BleepingComputer: Windows 11 KB5132061 and KB5131087 cumulative updates www.bleepingcomputer.com
- Microsoft November 2026 Patch Tuesday overview www.warp2search.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:13.
Original description (NVD)
Inclusion of functionality from untrusted control sphere in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.