Windows Graphics Kernel: Privilege escalation through integer overflow

Summary

A integer overflow or wraparound in the Windows Graphics Kernel allows a local attacker with a low-privileged account to elevate privileges. Microsoft rates the flaw as Elevation of Privilege with CVSS 3.1 7.8 (High). No user interaction is required, and the flaw cannot be exploited remotely. An attacker who already has a foothold, for example through phishing or malware, could gain SYSTEM rights.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846 (the CVE.org record lists 10.0.19044.7846, probably a typo; verify in MSRC)
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2: builds before 10.0.26100.9974
• Windows 11 Version 25H2: builds before 10.0.26200.9974
• Windows 11 Version 26H2: builds before 10.0.26300.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows Server 2022: builds before 10.0.20348.5870

Fixed in

• Install the November 2026 Windows security update (cumulative update) for the affected version. Confirm the exact build and KB number for each product in the MSRC Security Update Guide.

Workaround

Unknown. No vendor workaround is documented. Until patching, restrict local and interactive logon on multi-user systems such as terminal servers (general hardening, not a vendor recommendation).

Exploitation

• Exploited in the wild: no evidence found. Verify the MSRC 'Exploitation Detected' flag directly.
• Public proof of concept: none found.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.

Our recommendation

• Install the November 2026 Windows security update on all affected systems, prioritising multi-user PCs, terminal servers, domain controllers and file servers.
• Install the other Windows Graphics Kernel elevation-of-privilege fixes from the same release together with this one.
• Until patching, restrict local logon and interactive access on multi-user systems.
• Check the MSRC advisory and CISA KEV status again before closing the ticket.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-95935 msrc.microsoft.com
• CVE.org record CVE-2026-95935 www.cve.org
• VulDB entry CVE-2026-95935 vuldb.com
• Strix tracker CVE-2026-95935 www.strix.ai
• Qualys Patch Tuesday review November 2026 blog.qualys.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:58.