Microsoft Windows: Elevation of privilege in Graphic Fonts (heap-based buffer overflow)

Summary

A heap-based buffer overflow in the Windows Graphic Fonts component allows an authorized local attacker to elevate privileges. The attacker needs local access with low privileges and no user interaction. The impact on confidentiality, integrity and availability is rated high, so the flaw is mainly a second step after an attacker has already gained a foothold on a system.

Affected

• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33822

Note: Version data taken from the CVE record. Verify against the MSRC advisory before patching.

Fixed in

Install the November 2026 Windows security update for each affected branch, which brings the systems to the builds listed above or later. KB numbers: Unknown.

Workaround

Unknown. No vendor-documented workaround has been identified. Patching is the only confirmed fix.

Exploitation

• No evidence of active exploitation in the wild found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found.
• Not listed in CISA KEV according to a third-party aggregator.
• NVD status at publication: Awaiting Analysis.

Our recommendation

• Apply the November 2026 Windows update to all affected systems, starting with multi-user systems such as terminal servers and shared workstations.
• Verify the installed build numbers against the MSRC advisory.
• Review which local accounts have unnecessary privileges and reduce them.
• Monitor privileged activity on critical systems.
• Re-check NVD and MSRC for analysis updates and changes to exploitation status.
• Patch the separate Graphic Fonts issue CVE-2026-119969 in the same cycle, as it is rated more severe.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96084 msrc.microsoft.com
• CVE Record CVE-2026-96084 (CVE.org) www.cve.org
• Strix: CVE-2026-96084 www.strix.ai
• Action1: Patch Tuesday November 2026 www.action1.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:37.