Microsoft Windows: Elevation of privilege in Windows Graphics Kernel

Summary

Microsoft has published CVE-2026-96168 for the Windows Graphics Kernel, a core Windows component that handles graphics and display. An attacker with local access and a low-privileged account, or an existing foothold such as malware running as a user, can trigger an untrusted pointer dereference to gain higher privileges. Successful exploitation would allow full loss of confidentiality, integrity and availability on the affected system. The attack is rated as high complexity and not automatable, and no evidence of active exploitation is known.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Install the Microsoft cumulative update that brings the build to the fixed version or higher for your Windows release, as listed in the affected ranges above.
• Verify the exact fixed builds and update package in the MSRC Security Update Guide before rollout.

Workaround

Unknown.

Exploitation

• Exploited in the wild: No evidence found at the time of research.
• Not listed in the CISA KEV catalog at the time of research.
• CVSS exploit code maturity is 'unproven' (E:U).
• Public proof of concept: Nothing found.

Our recommendation

• Patch affected Windows systems with the current cumulative update, starting with Windows 10 1607 and 1809 and with Windows Server 2016 and 2019.
• Prioritise multi-user systems such as terminal servers and shared PCs, where a low-privileged foothold is most likely.
• Check your inventory for the affected builds and confirm the patch level.
• Reduce the risk of footholds through phishing protection, least-privilege accounts and endpoint monitoring for suspicious privilege changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-96168 msrc.microsoft.com
• CVE Record: CVE-2026-96168 www.cve.org
• Strix.ai: CVE-2026-96168 www.strix.ai
• OffSeq Radar: CVE-2026-96168 radar.offseq.com
• CISA KEV alert, 13 Oct 2026 www.cisa.gov

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:35.