Windows: Heap-based buffer overflow in Win32k GRFX allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows Graphics Component (GRFX) of Win32k allows an authorized local attacker to elevate privileges. The attacker needs local code execution or a valid low-privilege account, for example after phishing malware or a stolen password. Successful exploitation could fully compromise confidentiality, integrity and availability of the affected system. Microsoft has released fixes for the affected Windows builds.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to < 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to < 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to < 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to < 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to < 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to < 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to < 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to < 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to < 10.0.26300.9711
• Windows Server 2012: 6.2.9200.0 to < 6.2.9200.26434
• Also listed in the CVE record: Office 365 for Mac, Office LTSC for Mac 2021 and 2024, Office for Android

Fixed in

• Windows 10 Version 1607: 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.9711
• Windows Server 2012: 6.2.9200.26434
• Office for Mac: 16.114.26101123 or later
• Office for Android: 16.0.20430.20000 or later
• KB numbers: Unknown for Windows 10 1607; take them from the MSRC advisory

Workaround

Unknown. No workaround or mitigation was documented in the sources reviewed. Installing the vendor update is the only supported remediation.

Exploitation

• No evidence of in-the-wild exploitation or public proof of concept found
• CISA SSVC: exploitation none, automatable no, technical impact total
• EPSS score about 0.0036 at the time of capture
• CISA KEV status not verified

Our recommendation

• Inventory all Windows 10 1607 and other affected hosts
• Install the fixed builds from the MSRC advisory as soon as possible
• Plan migration off Windows 10 1607 and verify its support end on the Microsoft lifecycle page
• Restrict local logon on shared PCs, terminal servers and kiosks
• Monitor for unusual privilege escalation and check the CISA KEV catalogue

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center advisory CVE-2026-85908 msrc.microsoft.com
• NVD record mirrored on Vulners vulners.com
• VulDB entry CVE-2026-85908 vuldb.com
• Talos: Microsoft Patch Tuesday October 2026 blog.talosintelligence.com
• Strix CVE page CVE-2026-85908 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:46.