Windows GDI: Heap-based buffer overflow allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows GDI graphics component allows an authorized local user with low privileges to elevate their privileges on the affected system. Exploitation requires a local logon first, so the flaw is a privilege-escalation step after phishing or malware rather than an entry point. A successful attack would give the attacker high impact on confidentiality, integrity and availability.

Affected

• Windows 10 Version 1607, 1809, 21H2 and 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2
• Windows Server 2016 (including Server Core), 2019 (including Server Core) and 2022

Fixed in

Fixed builds per the CNA record (the affected range ends before these builds):

• Windows 10 1607: 10.0.14393.9688
• Windows 10 1809: 10.0.17763.9487
• Windows 10 21H2: 10.0.19044.7846
• Windows 10 22H2: 10.0.19045.7846
• Windows 11 23H2: 10.0.22631.7711
• Windows 11 24H2: 10.0.26100.9974
• Windows 11 25H2: 10.0.26200.9974
• Windows 11 26H1: 10.0.28000.3501
• Windows 11 26H2: 10.0.26300.9974
• Windows Server 2016: 10.0.14393.9688
• Windows Server 2019: 10.0.17763.9487
• Windows Server 2022: 10.0.20348.5870

Verify every build against the MSRC advisory before rollout, as a third-party list differs.

Workaround

Unknown.

• No vendor or third-party workaround identified; applying the Microsoft security update is the only confirmed fix.

Exploitation

• No evidence of exploitation in the wild found; no CISA KEV entry identified.
• No public proof-of-concept found; the CNA exploit maturity is unproven.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Pull the official MSRC entry and check the build numbers of all Windows systems (for example via WSUS, Intune or an inventory tool).
• Install the cumulative update from the November 2026 Patch Tuesday cycle or later and reboot.
• Prioritize multi-user systems, terminal servers and endpoints where untrusted files or documents are opened.
• Replace systems that are still on unsupported Windows 10 builds; check Microsoft's lifecycle pages.
• Recheck CISA KEV and NVD over the next few days, as the NVD status is still Awaiting Analysis.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-94527 msrc.microsoft.com
• CVE Record CVE-2026-94527 (CVE Program) www.cve.org
• Strix CVE-2026-94527 (third-party, not authoritative) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:12.