Windows Graphics Kernel: Out-of-bounds read enables local privilege escalation

Summary

A out-of-bounds read in the Windows Graphics Kernel allows an authorized local attacker to elevate privileges. The attacker needs low-privileged local access, such as a standard user session or malware already running on the system, and no user interaction is required. The CNA rates the impact as high for confidentiality, integrity and availability (CVSS 3.1 7.8).

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (build 10.0.19045.7846 per a third-party mirror, not confirmed by the CNA record)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 and 26H1: Unknown.
• Windows Server 2016, 2019 and 2022 including Server Core installations (builds before 10.0.14393.9688, 10.0.17763.9487 and 10.0.20348.5870)

Fixed in

• Fixed builds are listed in the Microsoft Security Update Guide (MSRC) entry for CVE-2026-95879. Verify the exact build and KB number there before deployment.
• Patch vehicle: the November 2026 cumulative update for Windows 10 21H2 (KB5131096) was released on 2026-11-10. Whether this KB contains the fix has not been confirmed.

Workaround

Unknown.

Exploitation

• No evidence of exploitation in the wild found.
• Not listed in the CISA KEV catalogue in the sources reviewed.
• No public proof of concept found.
• The CNA rates exploit maturity as unproven.

Our recommendation

• Check the Windows build on all endpoints and servers and compare it with the fixed builds in the MSRC advisory.
• Install the November 2026 security updates as a priority on multi-user systems, terminal servers and servers, and on endpoints where malware is a realistic risk.
• Confirm that older branches (1607, 1809, 21H2, 22H2) still receive security updates or are covered by an ESU plan; unsupported systems will not receive this fix.
• Recheck MSRC and NVD before the next patch cycle, as the affected build list may change.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-95879 msrc.microsoft.com
• CVE Record CVE-2026-95879 www.cve.org
• Strix CVE-2026-95879 (third-party mirror) www.strix.ai
• Senserva KB5131096 (third-party) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:11.