Windows Graphics Kernel: Use after free allows local privilege escalation

Summary

A use-after-free flaw (CWE-416) in the Windows Graphics Kernel allows an authorized local attacker to elevate privileges. Exploitation requires low privileges on the target system, such as a standard user account or a shared session, and no user interaction. Microsoft rates the impact on confidentiality, integrity and availability as high (CVSS 3.1: 7.8).

Affected

• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: fixed build not confirmed in the CVE record; a third-party source lists 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2 and 25H2, Windows 11 Version 26H2: fixed builds to be confirmed on MSRC (third-party data conflicts)
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows Server 2022: builds before 10.0.20348.5870
• Windows Server 2025 (including Server Core): builds before 10.0.26100.33822

Fixed in

• Security update of November 2026 (Patch Tuesday, 10 Nov 2026). No verified KB number was found.

Workaround

• Unknown. No workaround or mitigation was found in the sources; the fix is the security update.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof-of-concept or known exploitation was found at the time of research; this is not proof of absence.

Our recommendation

• Install the November 2026 security update on all affected Windows systems, prioritising multi-user systems, Remote Desktop and terminal servers.
• Verify the fixed build per edition on the MSRC advisory before rollout.
• Replace or upgrade Windows 10 systems that are no longer supported, or enrol them in Extended Security Updates.
• Monitor NVD and CISA KEV for changes and apply the whole November batch, which includes numerous Graphics Kernel fixes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-95895 msrc.microsoft.com
• CVE.org record CVE-2026-95895 www.cve.org
• Strix: CVE-2026-95895 (version data, third-party) www.strix.ai
• Senserva: Windows 10 21H2 security update overview (third-party) senserva.com
• News Beep: Patch Tuesday coverage www.newsbeep.com
• Cryptika: November 2026 Patch Tuesday www.cryptika.com
• Zero Day Initiative: November 2026 security update review www.zerodayinitiative.com
• Trinetri: Patch Tuesday overview trinetriops.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:06.