Microsoft Windows Graphics Kernel: Privilege escalation via out-of-bounds read

Summary

A local elevation-of-privilege flaw (CWE-125, out-of-bounds read) in the Windows Graphics Kernel affects multiple Windows 10, Windows 11 and Windows Server versions. An attacker who already has a low-privileged local account can exploit it to gain higher privileges, with high impact on confidentiality, integrity and availability (CVSS 3.1: 7.8). It is not remotely exploitable, so the main risk is post-compromise escalation on multi-user systems such as terminal servers.

Affected

• Windows 10 Version 1607: before 10.0.14393.9688
• Windows 10 Version 1809: before 10.0.17763.9487
• Windows 10 Version 21H2: before 10.0.19044.7846
• Windows 10 Version 22H2: before 10.0.19045.7846 (per third-party tracker; CVE record entry incomplete)
• Windows 11 Version 23H2: before 10.0.22631.7711
• Windows 11 Version 24H2: before 10.0.26100.9974
• Windows 11 Version 25H2: before 10.0.26200.9974
• Windows 11 Version 26H1: before 10.0.28000.3501
• Windows 11 Version 26H2: before 10.0.26300.9974
• Windows Server 2016 (incl. Server Core): before 10.0.14393.9688
• Windows Server 2019 (incl. Server Core): before 10.0.17763.9487
• Windows Server 2022: before 10.0.20348.5870
• Windows Server 2025: fixed build 10.0.26100.33822 (per third-party tracker, unverified)

Fixed in

• Security update released on November 10, 2026 (cumulative update; the exact KB number for this CVE is unverified)
• Fixed builds as listed under affected, to be checked against the MSRC advisory

Workaround

Unknown. No workaround or mitigation was found in any source; apply the patch.

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total
• No evidence of exploitation in the wild or of a public proof of concept found at the time of research
• Microsoft's exploitability flag for this CVE is unknown

Our recommendation

• Apply the November 10, 2026 cumulative update to all affected Windows 10, 11 and Server systems in the next Patch Tuesday cycle
• Prioritise terminal servers, RDS hosts and shared workstations
• Verify the exact fixed builds and KB number in the MSRC advisory before rollout
• Monitor for public proof-of-concept code or exploitation reports after publication

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-95909 msrc.microsoft.com
• CVE.org CVE Record: CVE-2026-95909 www.cve.org
• Strix AI: CVE-2026-95909 (third-party tracker) www.strix.ai
• Qualys: Microsoft Patch Tuesday November 2026 review blog.qualys.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:03.