Windows Graphics Kernel: Privilege escalation through untrusted pointer dereference

Summary

A flaw in the Windows Graphics Kernel allows an authorized local user to elevate privileges on the affected system. The weakness is an untrusted pointer dereference (CWE-822). An attacker needs local access and low privileges, and the attack complexity is high. No remote attack path is described, so this is mainly a risk where an attacker already has a foothold, for example through phishing or stolen credentials.

Affected

• Windows 10 Version 1607 (Server 2016 also affected): 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809 (Server 2019 also affected): 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9688 or later
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.9487 or later
• Windows 10 Version 21H2: 10.0.19044.7846 or later
• Windows 10 Version 22H2: 10.0.19045.7846 or later
• Windows 11 Version 23H2: 10.0.22631.7711 or later
• Windows 11 Version 24H2: 10.0.26100.9974 or later
• Windows 11 Version 25H2: 10.0.26200.9974 or later
• Windows 11 Version 26H1: 10.0.28000.3501 or later
• Windows 11 Version 26H2: 10.0.26300.9974 or later
• Windows Server 2022: 10.0.20348.5870 or later

The KB article for each build is not confirmed in the sources. Check the MSRC advisory before rollout.

Workaround

Unknown. No vendor-documented interim mitigation was found. Apply the fix.

Exploitation

• Exploited in the wild: no evidence found for this CVE.
• Public proof of concept: none found; status unknown.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• CVSS exploit code maturity: Unproven (E:U).
• CISA KEV: not checked.

Our recommendation

• Inventory all Windows systems by build number, including Windows 10 1607, 1809, 21H2 and 22H2 and Windows Server 2016, 2019 and 2022.
• Install the November 2026 cumulative update or later on every affected build and confirm the build number afterwards.
• Confirm that Windows 10 builds are still supported (ESU or LTSC) so the update is available.
• Prioritise systems used by staff who open attachments or documents from outside the company.
• Monitor the MSRC advisory and CISA KEV for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-95973 msrc.microsoft.com
• CVE Record: CVE-2026-95973 www.cve.org
• Rapid7: Patch Tuesday November 2026 www.rapid7.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:57.