Windows Graphics Kernel: Privilege escalation via untrusted pointer dereference

Summary

An untrusted pointer dereference in the Windows Graphics Kernel allows an attacker with local access and low privileges to elevate privileges on the system. Exploitation is rated high complexity, and the vulnerability cannot be exploited remotely. The main risk is a user or malware already on a workstation or shared terminal server gaining SYSTEM rights. The CVSS vector rates the impact on confidentiality, integrity and availability as high.

Affected

• Microsoft Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9688)
• Microsoft Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Microsoft Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Microsoft Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846)
• Microsoft Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Microsoft Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Microsoft Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Microsoft Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Microsoft Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Microsoft Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9688), including Server Core
• Microsoft Windows Server 2019 (10.0.17763.0 to before 10.0.17763.9487), including Server Core
• Microsoft Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)

Note: the version list comes from the CNA record and has not yet been confirmed against the MSRC advisory.

Fixed in

• Windows 10 1607 and Windows Server 2016: build 10.0.14393.9688 or later
• Windows 10 1809 and Windows Server 2019: build 10.0.17763.9487 or later
• Other listed versions: fixed builds as stated in the MSRC Security Update Guide (KB numbers unknown)

Workaround

Unknown.

No vendor workaround is known. Apply the security update.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• Microsoft's CVSS temporal metric rates exploit code maturity as unproven.
• No public proof of concept found at the time of writing.

Our recommendation

• Check the affected builds in the MSRC Security Update Guide entry.
• Deploy the cumulative November 2026 update through your normal patch cycle, prioritising terminal servers and multi-user systems.
• Restrict local logon and limit low-privilege accounts on shared systems.
• Monitor for signs of privilege escalation and recheck exploitation status before closing the ticket.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-95971 (CVE Program) www.cve.org
• MSRC Security Update Guide: CVE-2026-95971 msrc.microsoft.com
• Strix CVE-2026-95971 (third-party tracker, unverified) www.strix.ai
• Senserva known issues KB 5131096 (third-party, unverified) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:57.