BLOG
At a glance
- CVE-2026-95932 is a privilege-escalation flaw in Windows Graphics Kernel.
- Microsoft rates it Important, CVSS 3.1 7.8; local exploitation could lead to SYSTEM privileges.
- Microsoft reports no public disclosure or exploitation in the wild.
- Install the KB or fixed build matching the product and version.
CVE-2026-95932: Update Windows to fix a privilege-escalation flaw to SYSTEM
Microsoft disclosed CVE-2026-95932, a privilege-escalation flaw in Windows Graphics Kernel, rated Important with CVSS 3.1 score 7.8. A local attacker could elevate privileges to SYSTEM. Microsoft reports no exploitation in the wild; install the matching fixed KB or build.
In this article
Microsoft disclosed CVE-2026-95932 in Windows Graphics Kernel, a Windows kernel component that handles graphics functionality. The flaw requires an attacker to have local access; Microsoft recommends updating affected systems during the nearest maintenance window. Read Microsoft MSRC advisory CVE-2026-95932.
Overview and technical details
| Field | Details |
|---|---|
| Vulnerability | CVE-2026-95932 |
| Product/component | Windows Graphics Kernel |
| CWE | CWE-829: Inclusion of Functionality from Untrusted Control Sphere |
| Rating | Important; CVSS 3.1: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) |
| Disclosure/exploitation | Publicly Disclosed: No; Exploited in the Wild: No |
The flaw involves including functionality from an untrusted control sphere in Windows Graphics Kernel. Microsoft assesses that exploitation requires local access and could enable privilege escalation to SYSTEM.
Affected systems
The advisory record lists the following products and branches with their corresponding fixed updates or builds:
| Product/version | Fixed update or build |
|---|---|
| Microsoft Office 365 for Mac; Microsoft Office LTSC for Mac 2024; Microsoft Office LTSC for Mac 2021 | Build 16.115.26110837 (KBRelease Notes) |
| Microsoft Office for Android | Build 16.0.20625.20014 (KBRelease Notes) |
| Windows Server 2025; Windows Server 2025 (Server Core installation) | KB5131080 (Build 10.0.26100.33822), KB5131077 (Build 10.0.26100.33730) |
| Windows 11 Version 26H2 for x64-based Systems; Windows 11 Version 26H2 for ARM64-based Systems | KB5132061 (Build 10.0.26300.9974), KB5132043 (Build 10.0.26300.9911) |
| Windows 11 Version 25H2 for x64-based Systems; Windows 11 Version 25H2 for ARM64-based Systems | KB5132061 (Build 10.0.26200.9974), KB5132043 (Build 10.0.26200.9911) |
| Windows 11 Version 24H2 for x64-based Systems; Windows 11 Version 24H2 for ARM64-based Systems | KB5132061 (Build 10.0.26100.9974), KB5132043 (Build 10.0.26100.9911) |
| Windows 11 Version 23H2 for ARM64-based Systems; Windows 11 Version 23H2 for x64-based Systems | KB5131087 (Build 10.0.22631.7711) |
| Windows Server 2022 (Server Core installation); Windows Server 2022 | KB5131090 (Build 10.0.20348.5870) |
| Windows 10 Version 22H2 for ARM64-based Systems; Windows 10 Version 22H2 for 32-bit Systems; Windows 10 Version 22H2 for x64-based Systems | KB5131096 (Build 10.0.19045.7846) |
| Windows 10 Version 21H2 for x64-based Systems; Windows 10 Version 21H2 for ARM64-based Systems; Windows 10 Version 21H2 for 32-bit Systems | KB5131096 (Build 10.0.19044.7846) |
| Windows Server 2019; Windows Server 2019 (Server Core installation); Windows 10 Version 1809 for x64-based Systems; Windows 10 Version 1809 for 32-bit Systems | KB5131085 (Build 10.0.17763.9487) |
| Windows Server 2016 (Server Core installation); Windows Server 2016; Windows 10 Version 1607 for x64-based Systems; Windows 10 Version 1607 for 32-bit Systems | KB5131291 (Build 10.0.14393.9688) |
Exploitation status
Microsoft reports Publicly Disclosed: No and Exploited in the Wild: No. These are the statuses stated for this vulnerability in the record.
System checks
Check the Windows updates installed on the system:
Get-HotFixCheck operating-system and build information:
systeminfoCompare installed KBs and the operating-system version/build with the corresponding update in the affected-systems list. If the matching KB or fixed build is not present, update the system.
Remediation and mitigation
Install the KB or fixed build matching the product and version in use, using the affected-systems list above.
After installation, run
Get-HotFixto confirm the corresponding KB is installed; usesysteminfoto compare the build with the fixed build.
Related articles
Microsoft Windows Codecs Library: Patch Remote Code Execution Vulnerability CVE-2026-113749
Microsoft rates CVE-2026-113749 in Windows Codecs Library Critical; it can enable remote code execution over a network when a user interacts. No exploitation in the wild is reported. Install the update matching each Windows or Windows Server version.
CVE-2026-95948: Update Windows to address a Windows Graphics Kernel privilege-escalation flaw
Microsoft disclosed CVE-2026-95948, a stack-based buffer overflow in the Windows Graphics Kernel that could let an authenticated local attacker escalate privileges to SYSTEM. Microsoft lists CVSS 7.8; it is not publicly disclosed or exploited in the wild. Install the KB matching the affected…
CVE-2026-88217: Update Windows and Office to fix an information disclosure flaw
Microsoft disclosed CVE-2026-88217, an information disclosure flaw in Windows Graphics Kernel affecting certain Windows, Windows Server, and Microsoft Office versions. Local access is required, and no in-the-wild exploitation is reported. Install the applicable KB or build.
Microsoft Windows Codecs Library: Patch information disclosure flaw CVE-2026-96150
Microsoft identifies CVE-2026-96150 as an information disclosure flaw in Windows Codecs Library, affecting listed Windows versions and Microsoft Office for Android. Check the applicable KB and install the corresponding update; exploitation in the wild has not been reported.