BLOG
At a glance
- CVE-2026-96126 is a heap-based buffer overflow in Windows Graphics Kernel that may enable local privilege escalation.
- Microsoft lists Windows 10, Windows 11, Windows Server, and Microsoft Office for Android; successful exploitation may reach SYSTEM.
- CVSS 3.1 is 7.8 (Important); the vulnerability is not publicly disclosed and has not been exploited in the wild.
- Match the system branch and install the corresponding Microsoft KB/build.
Windows Graphics Kernel CVE-2026-96126 enables local privilege escalation; apply updates
Microsoft disclosed CVE-2026-96126, a heap-based buffer overflow in Windows Graphics Kernel that may let an already authorized local attacker escalate privileges to SYSTEM. Microsoft rates it CVSS 3.1 7.8; no in-the-wild exploitation is reported. Match and install the applicable KB.
In this article
Microsoft MSRC published information about CVE-2026-96126 on November 13, 2026. The flaw is in Windows Graphics Kernel and may allow an already authorized local user to escalate privileges; match the update to the system’s exact version.
Overview and technical details
Windows Graphics Kernel is a core Windows component that handles graphics functions. CVE-2026-96126 is a heap-based buffer overflow; successful exploitation may elevate privileges to SYSTEM.
| Field | Details |
|---|---|
| Vulnerability | CVE-2026-96126 |
| Type | CWE-122: Heap-based Buffer Overflow |
| Score | CVSS 3.1: 7.8 (Important) |
| CVSS vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Affected systems
Microsoft lists the following products and fixed builds. Where two builds/KBs appear in one row, they are kept in the order given in the source record.
| Product/branch | Listed build and KB |
|---|---|
| Microsoft Office for Android | Build 16.0.20625.20014 (KBRelease Notes) |
| Windows 11 Version 26H1, ARM64 and x64 | Build 10.0.28000.3501 (KB5132059) |
| Windows Server 2025, including Server Core | Build 10.0.26100.33822 (KB5131080); build 10.0.26100.33730 (KB5131077) |
| Windows 11 Version 26H2, x64 and ARM64 | Build 10.0.26300.9974 (KB5132061); build 10.0.26300.9911 (KB5132043) |
| Windows 11 Version 25H2, ARM64 and x64 | Build 10.0.26200.9974 (KB5132061); build 10.0.26200.9911 (KB5132043) |
| Windows 11 Version 24H2, x64 and ARM64 | Build 10.0.26100.9974 (KB5132061); build 10.0.26100.9911 (KB5132043) |
| Windows Server 2022, including Server Core | Build 10.0.20348.5870 (KB5131090) |
| Windows 11 Version 23H2, ARM64 and x64 | Build 10.0.22631.7711 (KB5131087) |
| Windows 10 Version 22H2, x64, ARM64, and 32-bit | Build 10.0.19045.7846 (KB5131096) |
| Windows 10 Version 21H2, x64, ARM64, and 32-bit | Build 10.0.19044.7846 (KB5131096) |
| Windows Server 2019, including Server Core; Windows 10 Version 1809, x64 and 32-bit | Build 10.0.17763.9487 (KB5131085) |
| Windows Server 2016, including Server Core; Windows 10 Version 1607, 32-bit and x64 | Build 10.0.14393.9688 (KB5131291) |
Mechanism and impact
The heap-based buffer overflow in Windows Graphics Kernel may be exploited locally by an attacker who has been granted access. The confirmed impact is privilege escalation; successful exploitation may reach SYSTEM.
Exploitation status
Microsoft reports that the vulnerability is not publicly disclosed (Publicly Disclosed: No) and has not been exploited in the wild (Exploited in the Wild: No). These are separate statuses stated in the record.
System checks
Check installed updates to compare them with the applicable KB.
Get-HotFix | Select-Object HotFixID, InstalledOnCheck system information to identify the Windows version and compare it with the applicable build.
systeminfo
A system is updated when the corresponding KB is installed and it reaches the listed build. If the KB is missing or the build is lower, deploy the applicable update.
Remediation and mitigation
Prioritize installing the KB and build corresponding to the Windows version in use, according to Microsoft’s update list.
Compare installed KBs and the system build with the listed levels above.
Source: Microsoft Security Response Center — CVE-2026-96126.
Related articles
CVE-2026-95953: Privilege escalation flaw in Windows Graphics Kernel and available updates
Microsoft rates CVE-2026-95953, a Windows Graphics Kernel privilege escalation flaw, Important with CVSS 3.1 7.8. An authenticated attacker could reach SYSTEM locally. No in-the-wild exploitation is reported; install the KB or build matching each affected product and version.
Microsoft patches CVE-2026-95942 privilege escalation in Windows Graphics Kernel
Microsoft rates CVE-2026-95942, a Windows Graphics Kernel privilege-escalation flaw, CVSS 3.1: 7.8. An authenticated attacker could exploit it locally to gain SYSTEM privileges. No public disclosure or in-the-wild exploitation is reported; install the matching update and verify the OS build.
CVE-2026-95922 in Windows: Local Privilege Escalation via Heap Buffer Overflow
Microsoft identifies CVE-2026-95922 as a heap buffer overflow in Windows Graphics Kernel that can let an existing user escalate locally to SYSTEM if a race condition is won. Rated CVSS 7.0 Important, it calls for the applicable update.
CVE-2026-111497: Update Windows, .NET and related products to address a Brotli flaw
Microsoft disclosed CVE-2026-111497, an out-of-bounds write in the Brotli decoder used by .NET that could enable elevation of privilege over a network. Exposure requires an application to use Brotli decompression; check affected products and versions, then install the applicable update.