Windows Advanced Rasterization Platform: Heap-based buffer overflow

Summary

A heap-based buffer overflow in the Windows Advanced Rasterization Platform (WARP) allows an authorized local attacker to elevate privileges. The attacker needs a valid low-privileged account on the affected system, and no user interaction is required. The flaw is not reachable directly from the internet; the main risk is escalation to SYSTEM after an initial compromise, for example by malware or a user with a standard account.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (incl. Server Core): 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
• Windows Server 2025 (incl. Server Core): 10.0.26100.0 to before 10.0.26100.33650

Fixed in

• Install the Microsoft security update for your Windows version. The fixed builds are the stated upper limits above (for example 10.0.19044.7807 for Windows 10 21H2).
• Verify the exact build numbers on the MSRC advisory before rollout.

Workaround

Unknown. No workaround was found in the sources. Install the security update for your build.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• No evidence of exploitation in the wild or public proof-of-concept code was found in the sources.
• Microsoft temporal vector: E:U (unproven exploit code maturity), RL:O, RC:C.

Our recommendation

• Inventory all Windows 10 (1809, 21H2, 22H2), Windows 11 and Windows Server 2019/2022/2025 hosts, and confirm their support status and Extended Security Updates eligibility. Unsupported builds will not receive the fix.
• Patch servers and multi-user systems first, such as Remote Desktop or terminal servers and shared workstations, then single-user workstations.
• Check the MSRC advisory and the NVD record for updated build numbers and exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-118227 msrc.microsoft.com
• CVE.org CVE Record: CVE-2026-118227 www.cve.org
• Strix.ai: CVE-2026-118227 (third-party, unverified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:14.