What is the CVSS score of CVE-2026-33104?

CVE-2026-33104 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Microsoft are affected by CVE-2026-33104?

CVE-2026-33104 is a local privilege escalation in Windows Win32K graphics subsystem affecting all supported Windows 10, Windows 11, and Windows Server 2012-2025 instances.. A patch is available.

How to fix or mitigate CVE-2026-33104?

Within 24 hours: Inventory all Windows 10, Windows 11, and Windows Server 2012-2025 systems in your environment and verify current patch levels against Microsoft's latest security updates addressing CVE-2026-33104. Within 7 days: Deploy vendor patches to all affected systems via your standard patch management process, prioritizing servers and systems with administrative users or high-value data access. Within 30 days: Complete patch deployment across entire Windows infrastructure and validate remediation through vulnerability scanning; audit privileged account activity logs for any suspicious low-to-SYSTEM privilege escalation attempts.

Microsoft CVE-2026-33104

EUVD-2026-22629 HIGH

Race Condition (CWE-362)

2026-04-14 microsoft

GHSA-2jq3-gg4w-j24c

Information Disclosure Race Condition Microsoft

7.0

CVSS 3.1 · NVD

Temporal: 6.1

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.1 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:37 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22629

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:58 nvd

HIGH 7.0

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Windows Win32K graphics subsystem (Win32K-GRFX) allows authenticated attackers with low privileges to gain SYSTEM-level access by exploiting a race condition during concurrent resource access. Affects all supported Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Microsoft has released patches addressing this CWE-362 synchronization flaw. No public exploit identified at time of analysis, though the local attack vector and high complexity (

Technical ContextAI

This vulnerability exists in the Windows Win32K graphics driver subsystem (Win32K-GRFX), specifically in kernel-mode components responsible for managing graphics resources and rendering operations. The root cause is CWE-362 (Race Condition), where multiple threads or processes can access shared kernel resources without proper synchronization primitives (locks, mutexes, or atomic operations). Win32K operates at ring-0 (kernel mode) and handles graphics device interface (GDI) operations, window management, and display driver interactions. When concurrent operations manipulate shared kernel objects without adequate locking mechanisms, a time-of-check-to-time-of-use (TOCTOU) window opens, allowing a local attacker to corrupt kernel memory structures or manipulate object states between validation and use. The high attack complexity (AC:H) indicates successful exploitation requires winning narrow race windows, likely through repeated attempts or precise system state manipulation. The vulnerability spans the entire Windows ecosystem from legacy Server 2012 (NT 6.2) through modern Windows 11 26H1 and Server 2025 (NT 10.0), indicating a long-standing architectural issue in the Win32K synchronization model.

RemediationAI

Microsoft has released security updates addressing this vulnerability across all affected platforms. Organizations should immediately deploy patches through Windows Update, WSUS, or enterprise management tools. For Windows 10 version 1607, upgrade to build 10.0.14393.9060 or later. Windows 10 version 1809 requires build 10.0.17763.8644 or later. Windows 10 versions 21H2 and 22H2 require builds 10.0.19044.7184 and 10.0.19045.7184 respectively. Windows 11 version 22H3 and 23H2 require build 10.0.22631.6936 or later. Windows 11 version 24H2 and Server 2025 require build 10.0.26100.32690 or later. Windows 11 version 25H2 requires build 10.0.26200.8246 or later, and version 26H1 requires build 10.0.28000.1836 or later. Server platforms require: Windows Server 2012 build 6.2.9200.26026+, Server 2012 R2 build 6.3.9600.23132+, Server 2016 build 10.0.14393.9060+, Server 2019 build 10.0.17763.8644+, and Server 2022 builds 10.0.20348.5020+ (standard) or 10.0.25398.2274+ (23H2 edition). No workarounds are available; patching is the only remediation. Detailed patch guidance available at the Microsoft Security Response Center advisory linked above. Prioritize domain controllers, terminal servers, and multi-user systems where low-privileged users have interactive access.