Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local access with low-privilege account
  2. Exploit
    Identify shared resource in Graphics Component
  3. Execution
    Exploit race condition during concurrent access
  4. Impact
    Achieve privilege escalation to higher privilege level

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires local system access with at least low-privilege user account. Must identify specific shared resource in Microsoft Graphics Component vulnerable to race conditions under concurrent execution scenarios.
Impact

CVSS 7.0 (HIGH). Attack vector: Local. Complexity: High. Privileges required: Low. User interaction: None. Exploitable via local access.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to compromise the affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Local privilege escalation in Microsoft Graphics Component on Windows Server 2016 and Windows 11 23h2 stems from improper synchronization of shared resources, enabling authenticated attackers to gain elevated privileges. The race condition vulnerability requires local access and specific timing conditions but carries high impact potential across confidentiality, integrity, and availability. No patch is currently available for this vulnerability.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:55 CVSS 7.0

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. [CVSS 7.0 HIGH]

RemediationAI

Monitor vendor advisories for a patch.

Affected Packages

microsoft windows_10_version_1607_10_0_14393_8957 fix: Windows 10 Version 1607 for 32-bit Systems 10.0.14393.8957, Windows 10 Version 1607 for x64-based Systems 10.0.14393.8957
microsoft windows_10_version_1809_10_0_17763_8511 fix: Windows 10 Version 1809 for 32-bit Systems 10.0.17763.8511, Windows 10 Version 1809 for x64-based Systems 10.0.17763.8511
microsoft windows_10_version_21h2_10_0_19044_7058 fix: Windows 10 Version 21H2 for 32-bit Systems 10.0.19044.7058, Windows 10 Version 21H2 for ARM64-based Systems 10.0.19044.7058, Windows 10 Version 21H2 for x64-based Systems 10.0.19044.7058
microsoft windows_10_version_22h2_10_0_19045_7058 fix: Windows 10 Version 22H2 for 32-bit Systems 10.0.19045.7058, Windows 10 Version 22H2 for ARM64-based Systems 10.0.19045.7058, Windows 10 Version 22H2 for x64-based Systems 10.0.19045.7058
microsoft windows_11_version_23h2_10_0_22631_6783 fix: Windows 11 Version 23H2 for ARM64-based Systems 10.0.22631.6783, Windows 11 Version 23H2 for x64-based Systems 10.0.22631.6783
microsoft windows_server_2012_6_2_9200_25973 fix: Windows Server 2012 6.2.9200.25973, Windows Server 2012 (Server Core installation) 6.2.9200.25973
microsoft windows_server_2012_r2_6_3_9600_23074 fix: Windows Server 2012 R2 6.3.9600.23074, Windows Server 2012 R2 (Server Core installation) 6.3.9600.23074
microsoft windows_server_2016_10_0_14393_8957 fix: Windows Server 2016 10.0.14393.8957, Windows Server 2016 (Server Core installation) 10.0.14393.8957
microsoft windows_server_2019_10_0_17763_8511 fix: Windows Server 2019 10.0.17763.8511, Windows Server 2019 (Server Core installation) 10.0.17763.8511
microsoft windows_server_2022_10_0_20348_4893 fix: Windows Server 2022 10.0.20348.4893, Windows Server 2022 (Server Core installation) 10.0.20348.4893
microsoft windows_server_2022_23h2_edition_10_0_25398_2207 fix: Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.2207

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 11 packages in microsoft

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-362 (Race Condition). Affects the Microsoft Graphics component of Windows 10 1607. Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Know when Industrial gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Zero Day Initiative Advisories

ZDI-26-180 Microsoft Windows cdd Improper Locking Local Privilege Escalation Vulnerability Mar 2026 ZDI-26-179 Microsoft Windows win32kfull Improper Locking Local Privilege Escalation Vulnerability Mar 2026 ZDI-26-178 Microsoft Windows cdd Improper Locking Local Privilege Escalation Vulnerability Mar 2026

Executive ViewAI

Why It Matters

A race condition vulnerability in Microsoft Graphics Component allows authenticated users to gain elevated system privileges on Windows systems, potentially leading to unauthorized access to sensitive data or critical system functions. This vulnerability affects organizations running Microsoft Windows and requires immediate mitigation planning since no patch is currently available.

Business Impact: High
Compensating Controls

Restrict local logon and interactive session privileges to trusted users only; disable GPU acceleration and graphics rendering features where operationally feasible; implement privileged access management (PAM) and multi-factor authentication (MFA) for administrative accounts; enforce User Account Control (UAC) settings at maximum; apply Windows Defender Application Guard isolation; segment graphics processing workloads to dedicated, air-gapped systems; conduct enhanced monitoring of privilege escalation attempts and Graphics Component access; consider temporary disabling of Remote Desktop Protocol (RDP) on high-risk systems if not operationally critical.

Threat Intelligence Overview

EPSS Score
0.0%
Top 90% exploitable
Exploit
POC
Public exploit code exists
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

55
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +35
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

Affected Products (CPE)CVE.org

cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*

Related Vulnerabilities in Microsoft Windows Multiple Privilege Escalation

View all 37
CVE-2026-23673 HIGH
7.8
CVE-2026-24287 HIGH
7.8
CVE-2026-25165 HIGH
7.8
CVE-2026-23667 HIGH
7.0
CVE-2026-24290 HIGH
7.8
CVE-2026-25167 HIGH
7.4
CVE-2026-25174 HIGH
7.8
CVE-2026-25187 HIGH
7.8
CVE-2026-23665 HIGH
7.8
CVE-2026-23669 HIGH
8.8
CVE-2026-23671 HIGH
7.0
CVE-2026-23672 HIGH
7.8
CVE-2026-23674 HIGH
7.5
CVE-2026-24283 HIGH
8.8
CVE-2026-24285 HIGH
7.0
CVE-2026-24289 HIGH
7.8
CVE-2026-24291 HIGH POC
7.8
CVE-2026-24292 HIGH
7.8
CVE-2026-24293 HIGH
7.8
CVE-2026-24294 HIGH
7.8
CVE-2026-24295 HIGH
7.0
CVE-2026-24296 HIGH
7.0
CVE-2026-25169 MEDIUM
6.2
CVE-2026-25170 HIGH
7.0
CVE-2026-25171 HIGH
7.0
CVE-2026-25172 HIGH POC
8.0
CVE-2026-25173 HIGH POC
8.0
CVE-2026-25175 HIGH
7.8
CVE-2026-25176 HIGH
7.8
CVE-2026-25177 HIGH
8.8
CVE-2026-25178 HIGH
7.0
CVE-2026-25179 HIGH
7.0
CVE-2026-25181 HIGH
7.5
CVE-2026-25188 HIGH
8.8
CVE-2026-25189 HIGH
7.8
CVE-2026-25190 HIGH
7.8

More in Industrial

View all
CVE-2025-63624 CRITICAL POC
9.8 Feb 03

Kede Electronics IoT smart water meter monitoring platform v1.0 has a SQL injection allowing attackers to compromise the
CVE-2026-24857 CRITICAL POC
9.8 Jan 28

bulk_extractor digital forensics tool starting from version 1.4 has a heap buffer overflow in its embedded unrar code th
CVE-2026-23519 CRITICAL POC
9.8 Jan 15

RustCrypto CMOV before 0.4.4 emits non-constant-time assembly on ARM Cortex-M0/M0+/M1 targets. Cryptographic operations

CVE-2021-47881 HIGH POC
8.4 Jan 23

dataSIMS Avionics ARINC 664-1 version 4.5.3 contains a local buffer overflow vulnerability that allows attackers to over
CVE-2026-22850 HIGH POC
8.3 Jan 19

SQL injection in Koko Analytics for WordPress prior to version 2.1.3 allows unauthenticated attackers to inject maliciou
CVE-2026-22700 HIGH POC
7.5 Jan 10

RustCrypto's SM2 elliptic curve implementation in versions 0.14.0-pre.0 and 0.14.0-rc.0 is vulnerable to denial-of-servi
CVE-2026-26025 HIGH POC
7.5 Feb 24

free5GC SMF versions up to 1.4.1 crash when receiving malformed PFCP SessionReportRequest packets on UDP port 8805, allo
CVE-2026-26024 HIGH POC
7.5 Feb 24

free5GC SMF versions up to 1.4.1 crash when processing malformed PFCP SessionReportRequest messages on the UDP/8805 inte
CVE-2026-25501 HIGH POC
7.5 Feb 24

free5GC SMF versions up to 1.4.1 crash when processing malformed PFCP SessionReportRequest messages on the PFCP interfac
CVE-2019-25291 HIGH POC
7.5 Jan 08

INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distribution image that ca
CVE-2026-22689 MEDIUM POC
6.5 Jan 10

Mailpit versions up to 1.28.2 contains a vulnerability that allows attackers to intercept sensitive data such as email c
CVE-2025-64075 CRITICAL
10.0 Feb 11

Authentication bypass via path traversal in ZBT WE2001 router's check_token function. EPSS 0.69% — crafted requests bypa

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2025-39964 MEDIUM POC
5.5

Same technique Race Condition

View all
CVE-2026-27175 CRITICAL POC
9.8

References

Advisories & patches
ADVISORY https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23668 ADVISORY https://vuldb.com/?id.349987

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy