Microsoft Windows Graphics Kernel: Heap overflow allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows Graphics Kernel affects several supported and extended-support Windows 10, Windows 11 and Windows Server versions. An authorized local user with low privileges can exploit it to elevate privileges, potentially gaining full control of the system. It is not a remote vulnerability, so an attacker first needs a local foothold, for example through a phished user or a compromised account. Microsoft rates it CVSS 7.0 (High) and no exploitation was known at publication.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 before 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (10.0.14393.0 before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (10.0.17763.0 before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 before 10.0.20348.5870)

Fixed in

• Fixed builds per the CNA record: 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974, 10.0.20348.5870
• Microsoft's November 2026 security updates (Patch Tuesday, 10 Nov 2026) provide these fixes. KB numbers for each product should be verified on the MSRC page.
• Windows 10 21H2 and 22H2 (ESU/LTSC) are covered by KB5131096 according to the Microsoft support page.

Workaround

Unknown. No Microsoft workaround was found. Installing the November 2026 security update is the fix.

Exploitation

• Microsoft's CVSS temporal vector indicates exploit code maturity 'Unproven' at publication.
• No public proof-of-concept or active exploitation was found.
• Not listed in CISA's KEV catalog as far as could be determined.
• NVD status was 'Awaiting Analysis' at research time.

Our recommendation

• Apply the November 2026 cumulative update to all affected Windows systems, prioritising multi-user systems such as Remote Desktop and terminal servers and shared workstations.
• Check which Windows 10 1607, 1809, 21H2 and 22H2 systems are in use and confirm ESU or LTSC licensing where needed to receive the fix.
• Verify the exact fixed builds and KB numbers on the MSRC update guide.
• Monitor CISA KEV and NVD for changes, as the CVE was published only on 10 Nov 2026.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-95938 msrc.microsoft.com
• CVE.org CVE Record: CVE-2026-95938 www.cve.org
• Microsoft Support: KB5131096 Windows 10 21H2/22H2 security update support.microsoft.com
• BleepingComputer: Windows 10 KB5131096 extended security update www.bleepingcomputer.com
• Action1: Patch Tuesday November 2026 www.action1.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:02.