Windows Advanced Rasterization Platform: Stack-based buffer overflow (privilege escalation)

Summary

A stack-based buffer overflow in the Windows Advanced Rasterization Platform (WARP), a software graphics rasterizer used by Windows components, allows an authorized local user to elevate privileges. The CVSS score is 8.8 (High) with a scope change. Exploitation requires local access with low privileges and no user interaction, so this is a privilege-escalation step after an attacker has already gained a foothold.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: builds 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: builds 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: builds 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2 and Windows Server 2025 (including Server Core): builds 10.0.26100.0 to before 10.0.26100.9711 (Server 2025: before 10.0.26100.33650)
• Windows 11 Version 25H2: builds 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: builds 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: builds 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2022: builds 10.0.20348.0 to before 10.0.20348.5761

Fixed in

• Install the Microsoft security update for the affected Windows version from the MSRC advisory. The first patched builds are the build numbers listed after 'before' above.
• Confirm the exact cumulative update for each device with MSRC before rollout.

Workaround

Unknown. No vendor-documented workaround was found.

Exploitation

• Exploit code maturity is listed as Unproven (E:U), so no public exploit was known at publication.
• Not listed in CISA KEV according to a third-party aggregator; the KEV catalogue was not checked directly.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Patch affected Windows systems through Windows Update, WSUS or Intune in the next regular cycle, and prioritise multi-user systems, RDS/terminal servers and workstations where untrusted users or files are common.
• Check that Windows 10 1809, 21H2 and 22H2 devices still receive updates or are enrolled in Extended Security Updates.
• Treat this CVE together with the related WARP memory-corruption CVEs published the same day as one patch batch.
• Verify build numbers against the MSRC advisory before rollout.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-118283 msrc.microsoft.com
• CVE Record: CVE-2026-118283 www.cve.org
• Strix: CVE-2026-118283 www.strix.ai
• Microsoft MSRC: related WARP advisory CVE-2026-26178 msrc.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:05.