Microsoft Graphics Component: Out-of-bounds read leads to local privilege escalation

Summary

A out-of-bounds read in the Microsoft Graphics Component of Windows allows an attacker with local access and a low-privilege account to elevate privileges. No user interaction is required. The CVSS 3.1 base score is 7.8 (High), and the impact is rated total for confidentiality, integrity and availability. Windows Server 2019 is affected as well, and the risk is highest on shared or multi-user systems.

Affected

• Windows 10 Version 1809 (builds below 10.0.17763.9376); - Windows Server 2019 and Server Core installation (below 10.0.17763.9376); - Windows 10 Version 21H2 (below 10.0.19044.7807); - Windows 10 Version 22H2 (below 10.0.19045.7807); - Windows 11 Version 23H2 (below 10.0.22631.7652); - Windows 11 Version 24H2 (below 10.0.26100.9711); - Windows 11 Version 25H2 (below 10.0.26200.9711); - Windows 11 Version 26H1 (below 10.0.28000.3231); - Windows 11 Version 26H2 (below 10.0.26300.9711); - Windows Server 2022 (below 10.0.20348.5761); - Windows Server 2025 and Server Core installation (below 10.0.26100.33650)

Fixed in

• Windows 10 1809 and Server 2019: build 10.0.17763.9376 or later (October 2026 security update; KB5126651 according to a third-party index, not yet verified against the Microsoft Update Catalog); - Other versions: fixed builds as listed under Affected, or later.

Workaround

Unknown. No documented workaround was found; the security update is the only confirmed remedy. Check the MSRC page for a mitigations section.

Exploitation

• No evidence of exploitation in the wild; - CISA SSVC: exploitation none, automatable no; - Not listed in CISA KEV; - Microsoft rates exploitation as Unlikely and reports no public exploit code; - EPSS about 0.33 percent.

Our recommendation

• Install the October 2026 security update on all affected systems, prioritising multi-user Windows 10 1809 systems, terminal servers and Server 2019 hosts; - Verify the update KB number in the Microsoft Update Catalog before rollout; - Check whether the Windows edition is still supported and plan an upgrade if it is end-of-life; - Limit local logon rights and monitor for unusual privilege changes on shared systems.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-85338 msrc.microsoft.com
• OpenCVE: CVE-2026-85338 app.opencve.io
• Vulners: MSCVE MS:CVE-2026-85338 vulners.com
• Vulners: CVE-2026-85338 vulners.com
• Vulners: Rapid7 RAPID7:CVE-2026-85338 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:25.