Microsoft Graphics Component: Local privilege escalation via numeric truncation

Summary

A numeric truncation error in the Microsoft Graphics Component of Windows allows a locally authenticated attacker with a low-privilege account to elevate privileges. Successful exploitation can lead to high impact on confidentiality, integrity and availability of the affected system (CVSS 7.8, NVD). The attacker needs local access and an existing user session, so the risk is mainly a compromised user account or malware running as a standard user.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9612)
• Windows 10 Version 1809 (builds before 10.0.17763.9376)
• Windows 10 Version 21H2 (builds before 10.0.19044.7807)
• Windows 10 Version 22H2 (builds before 10.0.19045.7807)
• Windows 11 Version 23H2 (builds before 10.0.22631.7652)
• Windows 11 Version 24H2 (builds before 10.0.26100.9711)
• Windows 11 Version 25H2 (builds before 10.0.26200.9711)
• Windows 11 Version 26H1 (builds before 10.0.28000.3231)
• Windows 11 Version 26H2 (builds before 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (builds before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (builds before 6.3.9600.23470)
• Windows Server 2016 (builds before 10.0.14393.9612)

Fixed in

• Install the Microsoft security update for each affected edition; the fixed build is the one listed as the lower bound in the affected ranges above (per the CNA record).
• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612 or later.
• Windows 10 Version 21H2: 10.0.19044.7807 or later.
• Windows 11 Version 24H2: 10.0.26100.9711 or later.
• Confirm exact fixed builds for each edition in the MSRC advisory, as the aggregated data was not verified against it.

Workaround

Unknown.

• No workaround could be confirmed from the sources reviewed.
• Generally limit local logons and the number of users with accounts on affected systems.

Exploitation

• CISA SSVC: exploitation 'none', automatable 'no', technical impact 'total'.
• EPSS score is about 0.003.
• No public proof of concept or in-the-wild exploitation was found in the searches performed; this does not rule out that such exploitation exists.

Our recommendation

• Apply the Microsoft security update for Windows on all affected devices and prioritise devices with exposed or shared user access.
• Identify remaining Windows 10 Version 1607 devices (kiosks, POS, HMIs, fixed-function devices) and Windows Server 2016 hosts; Windows 10 1607 LTSB needs a decision on replacement, Extended Security Updates or isolation, as its support status should be verified with Microsoft.
• Review local accounts and restrict standard-user rights where possible.
• Monitor for unusual privilege changes or new processes started by standard users.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70123 msrc.microsoft.com
• Vulners CVE List record CVE-2026-70123 vulners.com
• Vulners MSCVE record MS:CVE-2026-70123 vulners.com
• OpenCVE record CVE-2026-70123 app.opencve.io
• Microsoft Windows release information learn.microsoft.com
• Wikipedia: Windows Server 2016 en.wikipedia.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:10.