Windows: Information disclosure via out-of-bounds read in Graphics Kernel
Summary
A local out-of-bounds read in the Windows Graphics Kernel allows an authorized attacker to disclose information. The record rates the confidentiality impact as High and integrity and availability as None. The attacker needs local access and low privileges, so the risk is mainly on shared workstations, terminal servers and systems where an attacker already has a foothold.
Affected
- Windows 11 23H2 (builds 10.0.22631.0 to < 10.0.22631.7711)
- Windows 11 24H2 (builds 10.0.26100.0 to < 10.0.26100.9974)
- Windows 11 25H2 (builds 10.0.26200.0 to < 10.0.26200.9974)
- Windows 11 26H1 (builds 10.0.28000.0 to < 10.0.28000.3501)
- Windows 11 26H2 (builds 10.0.26300.0 to < 10.0.26300.9974)
- Windows Server 2022 (builds 10.0.20348.0 to < 10.0.20348.5870)
- Windows Server 2025 and Server Core installation (builds 10.0.26100.0 to < 10.0.26100.33822)
Fixed in
- Windows 11 23H2: 10.0.22631.7711
- Windows 11 24H2: 10.0.26100.9974
- Windows 11 25H2: 10.0.26200.9974
- Windows 11 26H1: 10.0.28000.3501
- Windows 11 26H2: 10.0.26300.9974
- Windows Server 2022: 10.0.20348.5870
- Windows Server 2025 and Server Core: 10.0.26100.33822
Fixed builds are taken from the CVE record. Verify them on the MSRC page before rollout.
Workaround
Unknown. No vendor workaround or mitigation has been identified. The vendor update is the remediation.
Exploitation
- No evidence of exploitation in the wild found at the time of research.
- CISA SSVC: Exploitation none, not automatable, partial technical impact.
- CVSS temporal vector uses E:U (unproven exploit maturity).
- No public proof-of-concept found, which does not prove none exists.
- NVD status was Awaiting Analysis at the time of research.
Our recommendation
- Install the November 2026 cumulative update on all affected Windows 11 and Windows Server systems, and check the fixed build on the MSRC page for each product.
- Prioritise multi-user workstations, terminal servers and servers with interactive logons.
- Limit local interactive logons and keep low-privileged accounts to a minimum.
- Treat this as a regular patch cycle item, not an emergency.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE.org record CVE-2026-95946 www.cve.org
- Microsoft Security Update Guide CVE-2026-95946 msrc.microsoft.com
- Strix CVE-2026-95946 www.strix.ai
- Senserva KB5131090 (Windows Server 2022 update) senserva.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:34.
Original description (NVD)
Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to disclose information locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.