Microsoft Windows Graphics Kernel: Elevation of privilege via stack-based buffer overflow

Summary

A stack-based buffer overflow in the Windows Graphics Kernel allows an authorized local attacker to elevate privileges. The attacker needs a low-privileged local account and must already have an initial foothold on the system, for example through phishing or a malicious application. Successful exploitation can give the attacker full control over confidentiality, integrity and availability of the affected system, including SYSTEM rights. Microsoft has assigned a CVSS 3.1 base score of 7.8 (High). No exploitation in the wild is known at the time of writing.

Affected

• Windows 10 Version 1607: 10.0.14393.0 before 10.0.14393.9688
• Windows 10 Version 1809: 10.0.17763.0 before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 before 10.0.19044.7846
• Windows 10 Version 22H2: Unknown (range not confirmed; unverified third-party list: before 10.0.19045.7846)
• Windows 11 Version 23H2: unverified third-party list: before 10.0.22631.7711
• Windows 11 Version 24H2: unverified third-party list: before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 before 10.0.26300.9974
• Windows Server 2016 (including Server Core): 10.0.14393.0 before 10.0.14393.9688
• Windows Server 2019 (including Server Core): 10.0.17763.0 before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 before 10.0.20348.5870

Fixed in

• Security update for the listed builds (version numbers shown as 'before' above)
• KB number per Windows build: Unknown; verify on the MSRC update guide

Workaround

• Unknown. No Microsoft-published workaround was found.
• Until patched, restrict local logon to trusted users and limit execution of untrusted code (general hardening, not vendor guidance).

Exploitation

• Exploited in the wild: No evidence found.
• CVSS exploit maturity: Unproven (E:U).
• Public proof of concept: None found.
• Not listed in CISA KEV in the sources reviewed.

Our recommendation

• Install the Microsoft security update for the affected Windows builds as part of the regular monthly cycle, prioritising older builds that may be out of support.
• Verify the exact affected builds and KB numbers on the MSRC update guide before rollout.
• Limit local accounts and restrict who can run untrusted code on multi-user systems, terminal servers and RDS hosts.
• Monitor for unusual kernel-level crashes or privilege changes until patched.
• Watch for NVD analysis, KEV addition or public exploit code, which would raise the priority.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-95948 msrc.microsoft.com
• CVE Record: CVE-2026-95948 www.cve.org
• Third-party aggregator (unverified version data): CVE-2026-95948 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:56.