Windows WARP: Out-of-bounds read enables local privilege escalation

Summary

A out-of-bounds read in the Windows Advanced Rasterization Platform (WARP) allows an authorized local attacker to elevate privileges. An attacker needs local access and a low-privilege account, so the flaw is not directly reachable from the internet. Because the scope is changed and the impact is rated high for confidentiality, integrity and availability, a successful attack could fully compromise the system.

Affected

• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652; build numbers unverified)
• Windows 11 Version 24H2, 25H2 and 26H2 (build numbers in the CVE record and aggregator differ; verify on MSRC)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231 per CVE record)
• Windows Server 2019 and Server Core installation (10.0.17763.0 to before 10.0.17763.9376)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5761 per CVE record)
• Windows Server 2025 and Server Core installation (10.0.26100.0 to before 10.0.26100.33650 per CVE record)

Fixed in

• Fixed in the November 2026 Windows security update for each affected build.
• Exact fixed builds: confirm on the MSRC advisory, as the sources I could access are inconsistent or incomplete.

Workaround

Unknown.

Exploitation

• No evidence of exploitation in the wild found at the time of writing.
• No public proof-of-concept found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• CISA KEV listing: not verified.
• NVD analysis was still pending at the time of writing.

Our recommendation

• Install the November 2026 Windows cumulative update on all affected Windows 10, Windows 11 and Windows Server systems, after confirming the fixed build on the MSRC advisory.
• Prioritise multi-user PCs, terminal servers (RDS) and systems that handle untrusted content.
• Restrict local logons and standard user rights, as this flaw is typically used after an attacker already runs code as a standard user.
• Monitor for KEV addition or public proof-of-concept code and recheck MSRC and NVD.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-118232 msrc.microsoft.com
• CVE Record CVE-2026-118232 (CVE.org) www.cve.org
• Strix.ai: CVE-2026-118232 (aggregator, unverified build numbers) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:10.