At a glance
- CVE-2026-95942 is a privilege-escalation vulnerability in Windows Graphics Kernel.
- An authenticated user could exploit it locally to gain SYSTEM privileges.
- Microsoft rates it CVSS 3.1: 7.8; it is not publicly disclosed or exploited in the wild.
- Install the applicable update and verify the KB and OS Build afterward.
Microsoft patches CVE-2026-95942 privilege escalation in Windows Graphics Kernel
Microsoft rates CVE-2026-95942, a Windows Graphics Kernel privilege-escalation flaw, CVSS 3.1: 7.8. An authenticated attacker could exploit it locally to gain SYSTEM privileges. No public disclosure or in-the-wild exploitation is reported; install the matching update and verify the OS build.
In this article
Microsoft published an advisory for CVE-2026-95942 in Windows Graphics Kernel. Compare the product and release in use with Microsoft's security update information to identify the applicable fix.
Overview and technical details
Windows Graphics Kernel is a Windows kernel component that handles system graphics functions. The out-of-bounds read flaw could allow an authenticated attacker to exploit the system locally and elevate privileges to SYSTEM.
| Field | Details |
|---|---|
| Vulnerability | CVE-2026-95942 |
| Product/component | Windows Graphics Kernel |
| Classification | CWE-125: Out-of-bounds Read |
| CVSS | CVSS 3.1: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C); Microsoft's rating: Important |
| Disclosure and exploitation | Publicly Disclosed: No; Exploited in the Wild: No |
Affected systems
The list below records the products, releases, and fixing updates or builds in the source record. Where two KB/build pairs are listed, both are retained as provided in the source data.
| Product/release | Update or build listed |
|---|---|
| Microsoft Office 365 for Mac; Microsoft Office LTSC for Mac 2024; Microsoft Office LTSC for Mac 2021 | Build 16.115.26110837 (KBRelease Notes) |
| Microsoft Office for Android | Build 16.0.20625.20014 (KBRelease Notes) |
| Windows 10 Version 1607 for x64-based Systems; Windows 10 Version 1607 for 32-bit Systems; Windows Server 2016; Windows Server 2016 (Server Core installation) | KB5131291; Build 10.0.14393.9688 |
| Windows 11 version 26H1 for x64-based Systems; Windows 11 Version 26H1 for ARM64-based Systems | KB5132059; Build 10.0.28000.3501 |
| Windows Server 2025; Windows Server 2025 (Server Core installation) | KB5131080; Build 10.0.26100.33822; KB5131077; Build 10.0.26100.33730 |
| Windows 11 Version 26H2 for x64-based Systems; Windows 11 Version 26H2 for ARM64-based Systems | KB5132061; Build 10.0.26300.9974; KB5132043; Build 10.0.26300.9911 |
| Windows 11 Version 25H2 for x64-based Systems; Windows 11 Version 25H2 for ARM64-based Systems | KB5132061; Build 10.0.26200.9974; KB5132043; Build 10.0.26200.9911 |
| Windows 11 Version 24H2 for x64-based Systems; Windows 11 Version 24H2 for ARM64-based Systems | KB5132061; Build 10.0.26100.9974; KB5132043; Build 10.0.26100.9911 |
| Windows 11 Version 23H2 for x64-based Systems; Windows 11 Version 23H2 for ARM64-based Systems | KB5131087; Build 10.0.22631.7711 |
| Windows Server 2022; Windows Server 2022 (Server Core installation) | KB5131090; Build 10.0.20348.5870 |
| Windows 10 Version 22H2 for x64-based Systems; Windows 10 Version 22H2 for ARM64-based Systems; Windows 10 Version 22H2 for 32-bit Systems | KB5131096; Build 10.0.19045.7846 |
| Windows 10 Version 21H2 for ARM64-based Systems; Windows 10 Version 21H2 for 32-bit Systems; Windows 10 Version 21H2 for x64-based Systems | KB5131096; Build 10.0.19044.7846 |
| Windows Server 2019; Windows Server 2019 (Server Core installation); Windows 10 Version 1809 for 32-bit Systems; Windows 10 Version 1809 for x64-based Systems | KB5131085; Build 10.0.17763.9487 |
Exploitation status
Microsoft reports that the vulnerability is not publicly disclosed (Publicly Disclosed: No) and is not exploited in the wild (Exploited in the Wild: No). These are the statuses listed in the advisory at publication.
System checks
Check the Windows updates installed on the system with these commands:
Get-HotFix systeminfoCompare the installed KB and OS Build with the applicable update in the list. If the system has not reached the listed build, it needs the update.
Remediation and mitigation
Install the update corresponding to the Windows version or product in use, as listed in Microsoft's KBRelease Notes.
After updating, check the installed KB and OS Build again and confirm they match the corresponding update.
Related articles
CVE-2026-95922 in Windows: Local Privilege Escalation via Heap Buffer Overflow
Microsoft identifies CVE-2026-95922 as a heap buffer overflow in Windows Graphics Kernel that can let an existing user escalate locally to SYSTEM if a race condition is won. Rated CVSS 7.0 Important, it calls for the applicable update.
CVE-2026-111497: Update Windows, .NET and related products to address a Brotli flaw
Microsoft disclosed CVE-2026-111497, an out-of-bounds write in the Brotli decoder used by .NET that could enable elevation of privilege over a network. Exposure requires an application to use Brotli decompression; check affected products and versions, then install the applicable update.
Microsoft patches 1,093 November 2026 vulnerabilities: prioritize Outlook zero-day
Microsoft’s November 2026 updates address 1,093 vulnerabilities. Outlook spoofing flaw CVE-2026-124194 is a zero-day under active exploitation. Prioritize updates on systems using Outlook and back up important data before patching Windows.
CVE-2026-124194 in Outlook Is Being Exploited: Prioritize Mitigation Before the CISA Deadline
CISA confirms CVE-2026-124194 in Microsoft Office Outlook is being exploited in the wild. The vulnerability may enable network spoofing. Apply Microsoft's mitigation guidance and note the CISA deadline of 2026-11-24.