Microsoft Windows Graphics Kernel: Use-after-free allows local privilege escalation

Summary

A use-after-free flaw in the Windows Graphics Kernel, the kernel-mode graphics component of Windows, allows a local attacker to elevate privileges. The attacker must already have an authenticated, low-privilege user account on the affected system. Successful exploitation can give full control of the host, so the risk is highest on shared workstations, terminal servers and other multi-user systems.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2016, including Server Core (builds before 10.0.14393.9688)
• Windows Server 2019, including Server Core (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)
• Note: the list for Windows 10 22H2 and Windows 11 builds is taken from the CVE record; a third-party mirror lists differing builds, so verify against MSRC.

Fixed in

• Fixed in the builds listed above, as stated in the CVE record. Install the November 2026 security updates.
• The cumulative update (KB) per Windows version is not confirmed by the sources. Verify in the MSRC Security Update Guide.

Workaround

Unknown. No vendor mitigation or workaround is documented in the sources reviewed. Check the MSRC advisory for any stated mitigations.

Exploitation

• Microsoft has not confirmed exploitation in the wild for this CVE.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• No public proof of concept is confirmed.
• Not listed in CISA KEV as far as verified.

Our recommendation

• Install the November 2026 security updates on all affected systems, starting with shared, multi-user and server systems.
• Verify the fixed build and KB for each system in the MSRC Security Update Guide.
• Identify and retire Windows 10 systems that are out of support (21H2, 1607, 1809) or patch them where possible.
• Enforce least privilege and monitor for suspicious local privilege escalation with EDR.
• Recheck the NVD record and CISA KEV once analysis is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-95991 (CVE.org) www.cve.org
• MSRC Security Update Guide CVE-2026-95991 msrc.microsoft.com
• Strix CVE-2026-95991 (unverified build list) www.strix.ai
• Senserva KB5131096 (November 2026 updates) senserva.com
• Rapid7 Patch Tuesday November 2026 www.rapid7.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:53.