EUVD-2026-29664
GHSA-36p3-3fqr-h7j4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local vector and low privileges (authenticated user foothold), no interaction; kernel Win32k code execution crosses to SYSTEM so scope changes with total confidentiality, integrity, and availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
Articles & Coverage 1
AnalysisAI
Local privilege escalation in the Win32K GRFX (graphics) subsystem of Microsoft Windows allows an authenticated, low-privileged user to execute arbitrary code in the kernel context via a heap-based buffer overflow. All currently supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through 2025) are affected. There is no public exploit identified at time of analysis, and EPSS probability is very low (0.02%), but the total technical impact and low exploitation barrier make it a meaningful patch-priority for endpoint hardening.
Technical ContextAI
The flaw resides in Win32k, the kernel-mode component that implements the Windows GUI and graphics device interface, specifically the GRFX (graphics) code path. Win32k executes in ring 0, so memory-corruption bugs here translate directly into kernel code execution and full system compromise. The root cause is classified as CWE-122 (heap-based buffer overflow): a controllable allocation on the kernel heap is written past its bounds, corrupting adjacent heap metadata or object pointers that an attacker can leverage to hijack control flow. CPE data confirms the affected surface is the Microsoft Windows OS itself across client SKUs (windows_10_version_1607/1809/21H2/22H2, windows_11_version_22H3/23H2/24H2/25H2/26H1) and server SKUs (windows_server_2012 and, per EUVD version data, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025), including Server Core installations.
RemediationAI
Vendor-released patch: apply the Microsoft security update that raises each SKU to at or above its fixed build listed in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40403) - e.g. 10.0.19045.7291 for Windows 10 22H2, 10.0.26100.8457 for Windows 11 24H2, 10.0.20348.5139 for Server 2022, 10.0.26100.32860 for Server 2025. This is the definitive fix and should be deployed through your standard update channel. There is no vendor-published standalone workaround for a Win32k memory-corruption bug; because exploitation requires an authenticated local foothold, the meaningful compensating controls until patching are limiting who can run code on affected hosts - restrict interactive/RDP logon rights on multi-user and server hosts, enforce least-privilege on user accounts, and prioritize systems where untrusted users execute arbitrary code. Note the trade-off: tightening logon rights can disrupt legitimate remote administration and shared-workstation workflows, so scope it to high-risk hosts. Ensure kernel exploit mitigations (HVCI/Memory Integrity, and Win32k API restriction where compatible) remain enabled to raise exploitation difficulty.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today