Windows Advanced Rasterization Platform: Heap overflow, local privilege escalation
Summary
A heap-based buffer overflow in the Windows Advanced Rasterization Platform allows an authorized local attacker to elevate privileges. The CVSS score is 8.8 (high), with a changed scope and high impact on confidentiality, integrity and availability. An attacker needs a local, low-privilege account or foothold, so this is mainly a risk after an initial compromise.
Affected
- Windows 10 Version 1809: 10.0.17763.0 before 10.0.17763.9376
- Windows 10 Version 21H2: 10.0.19044.0 before 10.0.19044.7807
- Windows 10 Version 22H2: 10.0.19045.0 before 10.0.19045.7807
- Further Windows 11 and Windows Server branches are listed in the CNA record excerpt, but could not be fully verified. Check the complete list in the MSRC advisory.
Fixed in
- Windows 10 Version 1809: build 10.0.17763.9376 or later
- Windows 10 Version 21H2: build 10.0.19044.7807 or later
- Windows 10 Version 22H2: build 10.0.19045.7807 or later
- Fixes are part of the November 2026 Patch Tuesday updates. The KB mapping per branch is unknown.
Workaround
Unknown. No vendor-published workaround was found. Patching is the expected remediation.
Exploitation
- No evidence found of active exploitation in the wild or of public proof-of-concept code.
- CISA KEV listing: not found, which does not confirm it is absent.
- The CNA assigns exploit maturity E:U (Unproven).
Our recommendation
- Install the November 2026 cumulative updates on affected Windows systems, starting with multi-user systems, remote desktop and terminal servers, and Windows 10 machines on Extended Security Updates.
- Confirm that Windows 10 ESU devices are enrolled, because they receive updates only after enrollment.
- Check the MSRC advisory for the exact fixed builds and KB numbers per branch.
- Verify patch status with an inventory or patch management report after rollout.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Advanced Rasterization Platform
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126657, KB5126655, KB5126653, KB5127648, KB5126646
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (CNA) www.cve.org
- Microsoft Security Update Guide (MSRC advisory) msrc.microsoft.com
- BleepingComputer: Windows 10 KB5131096 and ESU update www.bleepingcomputer.com
- Strix CVE summary (secondary, version list not fully verified) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:12.
Original description (NVD)
Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.