BLOG
At a glance
- CVE-2026-95953 is a privilege escalation flaw in Windows Graphics Kernel, rated Important by Microsoft, with CVSS 3.1 7.8.
- The listed Windows, Windows Server, and some Office product versions are affected.
- An authenticated attacker could exploit it locally; successful exploitation could reach SYSTEM.
- Prioritize installing the KB or build matching the product and version.
CVE-2026-95953: Privilege escalation flaw in Windows Graphics Kernel and available updates
Microsoft rates CVE-2026-95953, a Windows Graphics Kernel privilege escalation flaw, Important with CVSS 3.1 7.8. An authenticated attacker could reach SYSTEM locally. No in-the-wild exploitation is reported; install the KB or build matching each affected product and version.
In this article
Microsoft published the CVE-2026-95953 advisory on 2026-11-13. The flaw is in Windows Graphics Kernel; Microsoft marks it as not publicly disclosed and not exploited in the wild. Compare your systems with the Microsoft MSRC advisory to select the applicable update.
Overview and technical details
Windows Graphics Kernel is a Windows kernel component that handles graphics functions. CVE-2026-95953 is an out-of-bounds read flaw that can lead to local privilege escalation.
| Field | Details |
|---|---|
| Product/component | Windows Graphics Kernel |
| Vulnerability | CVE-2026-95953 |
| Classification | CWE-125: Out-of-bounds Read |
| Microsoft rating | Important |
| CVSS score | CVSS 3.1: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) |
| Public disclosure / exploitation in the wild | Publicly Disclosed: No; Exploited in the Wild: No |
Affected systems
The advisory lists the following affected products and branches with their corresponding updates. For Windows Server 2025, Microsoft lists two KB/build pairs.
| Affected product and version | Update or build |
|---|---|
| Microsoft Office LTSC for Mac 2021; Microsoft Office 365 for Mac; Microsoft Office LTSC for Mac 2024 | Build 16.115.26110837 (KBRelease Notes) |
| Microsoft Office for Android | Build 16.0.20625.20014 (KBRelease Notes) |
| Windows 10 Version 1809 for 32-bit Systems; Windows Server 2019 (Server Core installation); Windows Server 2019; Windows 10 Version 1809 for x64-based Systems | KB5131085, Build 10.0.17763.9487 |
| Windows 11 version 26H1 for x64-based Systems; Windows 11 Version 26H1 for ARM64-based Systems | KB5132059, Build 10.0.28000.3501 |
| Windows Server 2025 (Server Core installation); Windows Server 2025 | KB5131080, Build 10.0.26100.33822; KB5131077, Build 10.0.26100.33730 |
| Windows 11 Version 26H2 for x64-based Systems; Windows 11 Version 26H2 for ARM64-based Systems | KB5132061, Build 10.0.26300.9974; KB5132043, Build 10.0.26300.9911 |
| Windows 11 Version 25H2 for x64-based Systems; Windows 11 Version 25H2 for ARM64-based Systems | KB5132061, Build 10.0.26200.9974; KB5132043, Build 10.0.26200.9911 |
| Windows 11 Version 24H2 for x64-based Systems; Windows 11 Version 24H2 for ARM64-based Systems | KB5132061, Build 10.0.26100.9974; KB5132043, Build 10.0.26100.9911 |
| Windows 11 Version 23H2 for ARM64-based Systems; Windows 11 Version 23H2 for x64-based Systems | KB5131087, Build 10.0.22631.7711 |
| Windows Server 2022 (Server Core installation); Windows Server 2022 | KB5131090, Build 10.0.20348.5870 |
| Windows 10 Version 22H2 for x64-based Systems; Windows 10 Version 22H2 for ARM64-based Systems; Windows 10 Version 22H2 for 32-bit Systems | KB5131096, Build 10.0.19045.7846 |
| Windows 10 Version 21H2 for x64-based Systems; Windows 10 Version 21H2 for ARM64-based Systems; Windows 10 Version 21H2 for 32-bit Systems | KB5131096, Build 10.0.19044.7846 |
| Windows Server 2016 (Server Core installation); Windows Server 2016; Windows 10 Version 1607 for x64-based Systems; Windows 10 Version 1607 for 32-bit Systems | KB5131291, Build 10.0.14393.9688 |
Mechanism and impact
An out-of-bounds read flaw in Windows Graphics Kernel can be exploited locally by an authenticated attacker. Successful exploitation could allow privilege escalation to SYSTEM; this is an elevation-of-privilege impact, not a finding of remote exploitation.
Exploitation status
Microsoft records Publicly Disclosed: No and Exploited in the Wild: No. According to this assessment, the flaw has not been publicly disclosed and is not being exploited in the wild.
System checks
- List installed Windows updates and compare the KB with the operating system branch in use:
Get-HotFix - Check operating system version and build information:
systeminfo
If Get-HotFix lists the KB matching the operating system branch, the update is recorded as installed. Otherwise, compare the version/build and deploy the applicable KB.
Remediation and mitigation
- Prioritize installing the KB or build matching the affected product and version during the nearest patch cycle.
- For Office for Mac and Office for Android, apply the build specified in KBRelease Notes.
- After updating Windows, confirm the KB appears in
Get-HotFixand that the build matches the one listed for the branch.
Related articles
Windows Graphics Kernel CVE-2026-96126 enables local privilege escalation; apply updates
Microsoft disclosed CVE-2026-96126, a heap-based buffer overflow in Windows Graphics Kernel that may let an already authorized local attacker escalate privileges to SYSTEM. Microsoft rates it CVSS 3.1 7.8; no in-the-wild exploitation is reported. Match and install the applicable KB.
Microsoft patches CVE-2026-95942 privilege escalation in Windows Graphics Kernel
Microsoft rates CVE-2026-95942, a Windows Graphics Kernel privilege-escalation flaw, CVSS 3.1: 7.8. An authenticated attacker could exploit it locally to gain SYSTEM privileges. No public disclosure or in-the-wild exploitation is reported; install the matching update and verify the OS build.
CVE-2026-95922 in Windows: Local Privilege Escalation via Heap Buffer Overflow
Microsoft identifies CVE-2026-95922 as a heap buffer overflow in Windows Graphics Kernel that can let an existing user escalate locally to SYSTEM if a race condition is won. Rated CVSS 7.0 Important, it calls for the applicable update.
CVE-2026-111497: Update Windows, .NET and related products to address a Brotli flaw
Microsoft disclosed CVE-2026-111497, an out-of-bounds write in the Brotli decoder used by .NET that could enable elevation of privilege over a network. Exposure requires an application to use Brotli decompression; check affected products and versions, then install the applicable update.