BLOG
At a glance
- CVE-2026-96144 is an information disclosure vulnerability in Windows Graphics Kernel.
- Listed Windows branches may expose small portions of local heap memory; CVSS 4.7 (Important).
- Microsoft reports that it is not publicly disclosed and has not been exploited in the wild.
- Check the branch and build, then install the corresponding KB listed in the advisory.
Windows Graphics Kernel: CVE-2026-96144 information disclosure and matching KB updates
Microsoft disclosed CVE-2026-96144, an information disclosure vulnerability in Windows Graphics Kernel that may expose small portions of local heap memory. Microsoft lists affected Windows branches and corresponding KBs; check the version and build, then install the applicable update.
In this article
Microsoft MSRC published advisory CVE-2026-96144 for a vulnerability in Windows Graphics Kernel, a core component that handles Windows graphics functions. Compare your systems with Microsoft’s information and update list to identify the applicable KB.
Overview and technical details
The flaw is described as use of an uninitialized resource. An authenticated attacker may disclose local information, potentially reading small portions of heap memory; exploitation requires winning a race condition and is highly complex.
| Field | Details |
|---|---|
| Product | Windows Graphics Kernel |
| Vulnerability | CVE-2026-96144 |
| CWE | CWE-908: Use of Uninitialized Resource |
| CVSS | 4.7 (Important); CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
| Status | Publicly Disclosed: No; Exploited in the Wild: No |
| Source | Microsoft MSRC |
Affected systems
The advisory lists the branches and updates below. Match the product, architecture, and build precisely; different KBs and builds should not be treated as one common update.
| Affected product and version | Listed KB and build |
|---|---|
| Microsoft Office for Android | KBRelease Notes, Build 16.0.20625.20014 |
| Windows 11 version 26H1, x64 and ARM64 | KB5132059 (Build 10.0.28000.3501) |
| Windows Server 2025, including Server Core installation | KB5131080 (Build 10.0.26100.33822); KB5131077 (Build 10.0.26100.33730) |
| Windows 11 Version 25H2, x64 and ARM64 | KB5132061 (Build 10.0.26200.9974); KB5132043 (Build 10.0.26200.9911) |
| Windows 11 Version 26H2, ARM64 and x64 | KB5132061 (Build 10.0.26300.9974); KB5132043 (Build 10.0.26300.9911) |
| Windows 11 Version 24H2, x64 and ARM64 | KB5132061 (Build 10.0.26100.9974); KB5132043 (Build 10.0.26100.9911) |
| Windows 11 Version 23H2, x64 and ARM64 | KB5131087 (Build 10.0.22631.7711) |
| Windows Server 2022, including Server Core installation | KB5131090 (Build 10.0.20348.5870) |
| Windows 10 Version 22H2, x64, ARM64, and 32-bit | KB5131096 (Build 10.0.19045.7846) |
| Windows 10 Version 21H2, x64, ARM64, and 32-bit | KB5131096 (Build 10.0.19044.7846) |
| Windows Server 2019, including Server Core installation; Windows 10 Version 1809, 32-bit and x64 | KB5131085 (Build 10.0.17763.9487) |
| Windows Server 2016, including Server Core installation; Windows 10 Version 1607, x64 and 32-bit | KB5131291 (Build 10.0.14393.9688) |
Exploitation status
Microsoft reports Publicly Disclosed: No and Exploited in the Wild: No. These are the statuses stated in the advisory; neither the CVSS score nor the Important rating changes those facts.
System checks
Check the installed Windows product name, version, and operating system build. Compare the branch and build with the update list above; a build lower than the corresponding fixed build needs to be updated.
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumberCheck whether the relevant security KBs are installed. If the KB for the corresponding branch does not appear, compare the build and update status to determine whether an update is needed.
Get-HotFix -Id KB5132059,KB5131080,KB5131077,KB5132061,KB5132043,KB5131087,KB5131090,KB5131096,KB5131085,KB5131291
Remediation and mitigation
Install the KB corresponding to the Windows version in use: KB5132059, KB5131080, KB5131077, KB5132061, KB5132043, KB5131087, KB5131090, KB5131096, KB5131085, or KB5131291, according to the listed product branch and build.
Prioritize the applicable update in the earliest update cycle. For Microsoft Office for Android, refer to KBRelease Notes, Build 16.0.20625.20014.
Reference: Microsoft MSRC — CVE-2026-96144.
Related articles
Windows Graphics Kernel CVE-2026-96126 enables local privilege escalation; apply updates
Microsoft disclosed CVE-2026-96126, a heap-based buffer overflow in Windows Graphics Kernel that may let an already authorized local attacker escalate privileges to SYSTEM. Microsoft rates it CVSS 3.1 7.8; no in-the-wild exploitation is reported. Match and install the applicable KB.
CVE-2026-95953: Privilege escalation flaw in Windows Graphics Kernel and available updates
Microsoft rates CVE-2026-95953, a Windows Graphics Kernel privilege escalation flaw, Important with CVSS 3.1 7.8. An authenticated attacker could reach SYSTEM locally. No in-the-wild exploitation is reported; install the KB or build matching each affected product and version.
Microsoft patches CVE-2026-95942 privilege escalation in Windows Graphics Kernel
Microsoft rates CVE-2026-95942, a Windows Graphics Kernel privilege-escalation flaw, CVSS 3.1: 7.8. An authenticated attacker could exploit it locally to gain SYSTEM privileges. No public disclosure or in-the-wild exploitation is reported; install the matching update and verify the OS build.
CVE-2026-95922 in Windows: Local Privilege Escalation via Heap Buffer Overflow
Microsoft identifies CVE-2026-95922 as a heap buffer overflow in Windows Graphics Kernel that can let an existing user escalate locally to SYSTEM if a race condition is won. Rated CVSS 7.0 Important, it calls for the applicable update.