BLOG
At a glance
- CVE-2026-95948 is a privilege-escalation flaw in the Windows Graphics Kernel.
- An authenticated local attacker could reach SYSTEM if exploitation succeeds.
- Microsoft lists CVSS 7.8; the flaw is not publicly disclosed or exploited in the wild.
- Install the KB matching the affected Windows version and architecture.
CVE-2026-95948: Update Windows to address a Windows Graphics Kernel privilege-escalation flaw
Microsoft disclosed CVE-2026-95948, a stack-based buffer overflow in the Windows Graphics Kernel that could let an authenticated local attacker escalate privileges to SYSTEM. Microsoft lists CVSS 7.8; it is not publicly disclosed or exploited in the wild. Install the KB matching the affected…
In this article
Microsoft disclosed CVE-2026-95948, a stack-based buffer overflow in the Windows Graphics Kernel. The Microsoft MSRC advisory lists the affected branches and corresponding updates.
Overview and technical details
The Windows Graphics Kernel is a Windows kernel component that handles operating-system graphics functions. The stack-based buffer overflow could allow an authenticated local attacker to escalate privileges; successful exploitation could reach SYSTEM.
| Field | Details |
|---|---|
| Vulnerability | CVE-2026-95948 |
| CWE | CWE-121: Stack-based Buffer Overflow |
| CVSS | 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) |
| Publicly Disclosed | No |
| Exploited in the Wild | No |
Affected systems
Microsoft lists the following products, branches, and updates. For branches with two KBs, the two corresponding builds are provided in the same order as the source data.
| Product/version | Update and build |
|---|---|
| Microsoft Office for Android | KBRelease Notes, Build 16.0.20625.20014 |
| Windows 11 version 26H1 (x64, ARM64) | KB5132059, Build 10.0.28000.3501 |
| Windows Server 2025; Windows Server 2025 (Server Core installation) | KB5131080, Build 10.0.26100.33822; KB5131077, Build 10.0.26100.33730 |
| Windows 11 Version 26H2 (x64, ARM64) | KB5132061, Build 10.0.26300.9974; KB5132043, Build 10.0.26300.9911 |
| Windows 11 Version 25H2 (x64, ARM64) | KB5132061, Build 10.0.26200.9974; KB5132043, Build 10.0.26200.9911 |
| Windows 11 Version 23H2 (x64, ARM64) | KB5131087, Build 10.0.22631.7711 |
| Windows 11 Version 24H2 (ARM64, x64) | KB5132061, Build 10.0.26100.9974; KB5132043, Build 10.0.26100.9911 |
| Windows Server 2022; Windows Server 2022 (Server Core installation) | KB5131090, Build 10.0.20348.5870 |
| Windows 10 Version 22H2 (32-bit, x64, ARM64) | KB5131096, Build 10.0.19045.7846 |
| Windows 10 Version 21H2 (x64, ARM64, 32-bit) | KB5131096, Build 10.0.19044.7846 |
| Windows Server 2019; Windows Server 2019 (Server Core installation); Windows 10 Version 1809 (32-bit, x64) | KB5131085, Build 10.0.17763.9487 |
| Windows Server 2016; Windows Server 2016 (Server Core installation); Windows 10 Version 1607 (x64, 32-bit) | KB5131291, Build 10.0.14393.9688 |
System checks
Check installed Windows KBs with the following command. Compare HotFixID with the KB for the correct operating-system version and branch; install the update if the corresponding KB is absent.
Get-HotFixCheck the Windows version and build against the update build. Compare the version, architecture, and OS Version with the product branch in the list.
systeminfo
Remediation and mitigation
Prioritize deploying the KB matching each affected operating-system version and architecture in the next maintenance window. Install the KB corresponding to the operating system in Microsoft's update list.
Related articles
Microsoft Windows Codecs Library: Patch Remote Code Execution Vulnerability CVE-2026-113749
Microsoft rates CVE-2026-113749 in Windows Codecs Library Critical; it can enable remote code execution over a network when a user interacts. No exploitation in the wild is reported. Install the update matching each Windows or Windows Server version.
CVE-2026-95932: Update Windows to fix a privilege-escalation flaw to SYSTEM
Microsoft disclosed CVE-2026-95932, a privilege-escalation flaw in Windows Graphics Kernel, rated Important with CVSS 3.1 score 7.8. A local attacker could elevate privileges to SYSTEM. Microsoft reports no exploitation in the wild; install the matching fixed KB or build.
CVE-2026-88217: Update Windows and Office to fix an information disclosure flaw
Microsoft disclosed CVE-2026-88217, an information disclosure flaw in Windows Graphics Kernel affecting certain Windows, Windows Server, and Microsoft Office versions. Local access is required, and no in-the-wild exploitation is reported. Install the applicable KB or build.
Microsoft Windows Codecs Library: Patch information disclosure flaw CVE-2026-96150
Microsoft identifies CVE-2026-96150 as an information disclosure flaw in Windows Codecs Library, affecting listed Windows versions and Microsoft Office for Android. Check the applicable KB and install the corresponding update; exploitation in the wild has not been reported.