Windows Graphics Kernel: Use-after-free leading to local privilege escalation

Summary

Several supported Windows 10, Windows 11 and Windows Server versions contain a use-after-free flaw in the Windows Graphics Kernel. A local user with low privileges can exploit it to gain higher privileges on the system. Exploitation requires an existing foothold on the machine and high attack complexity, and the flaw is not reachable remotely.

Affected

• Windows 10 Version 1607, 1809, 21H2 and 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2
• Windows Server 2016 (including Server Core), 2019 (including Server Core) and 2022
• Affected builds according to the CNA record: before 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974 and 10.0.20348.5870 (Server 2022)

Fixed in

• Fixed builds per CNA record: 10.0.14393.9688 (1607, Server 2016), 10.0.17763.9487 (1809, Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.28000.3501 (26H1), 10.0.26300.9974 (26H2), 10.0.20348.5870 (Server 2022)
• Fix is part of the Windows security updates released on 10 November 2026
• KB number: unknown; confirm on the MSRC page

Workaround

Unknown. No mitigation is documented in the available sources; applying the update is the remedy.

Exploitation

• Exploitation in the wild: not confirmed; the MSRC exploitation field could not be verified
• Public proof of concept: none found
• CISA SSVC: exploitation none, not automatable, total technical impact
• CVSS temporal vector E:U (exploit code maturity unproven)

Our recommendation

• Install the November 2026 Windows security update on all affected systems, prioritising multi-user systems, terminal/RDS servers and shared workstations
• Confirm installed builds against the MSRC fixed-build table
• Patch higher-rated November Graphics Kernel CVEs first, for example CVE-2026-119966
• Monitor the MSRC entry for updates to the exploitation status

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-95966 msrc.microsoft.com
• CVE Record CVE-2026-95966 (CVE.org) www.cve.org
• News summary (severity label differs by source) www.newsbeep.com
• Microsoft Security Update Guide: CVE-2026-119966 msrc.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:56.