Skip to main content

Severity by source

Vendor (microsoft) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.1 HIGH

Local authenticated attacker with no interaction (AV:L/PR:L/UI:N/AC:L); an OOB read most credibly yields info disclosure plus EoP-enabled integrity impact, so A:N unless corruption is confirmed.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 14, 2026 - 19:10 vuln.today
CVE Published
Jul 14, 2026 - 17:09 nvd
HIGH 7.8

DescriptionCVE.org

Out-of-bounds read in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Win32k GRFX subsystem across Windows 10, Windows 11, and Windows Server 2012 through 2025 lets an authenticated low-privileged local attacker elevate to SYSTEM by triggering an out-of-bounds read (CWE-125). The flaw was reported internally by Microsoft, a vendor patch is available via MSRC, and there is no public exploit identified at time of analysis. CVSS is 7.8 (High), reflecting a local vector with low complexity and low privileges required.

Technical ContextAI

Win32k is the Windows kernel-mode driver (win32k.sys / win32kfull.sys) implementing the GDI/graphics (GRFX) and windowing subsystem - historically one of the largest local kernel attack surfaces in Windows because it processes user-supplied graphics objects in ring 0. CWE-125 (Out-of-bounds Read) here indicates the GRFX component reads past the bounds of an allocated buffer while parsing or manipulating a graphics structure. Although an OOB read is classically an information-disclosure primitive, the affected CPEs span the full modern Windows kernel line (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2012 through 2025), consistent with a shared Win32k codepath; Microsoft's own tags label it both 'Information Disclosure' and 'Buffer Overflow'.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-56176 from the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56176), selecting the correct package for each affected SKU across Windows 10, Windows 11, and Windows Server 2012-2025 including Server Core; take the exact fixed build numbers from that advisory rather than assuming them. Because exploitation requires an existing local foothold, prioritize multi-user and shared systems (RDP/terminal session hosts, developer and jump boxes) where low-privileged accounts run untrusted code. Microsoft publishes no specific pre-patch workaround; as compensating controls, restrict interactive/local logon rights to trusted accounts (trade-off: may disrupt shared-access workflows), enforce application allowlisting to limit attacker code execution (trade-off: management overhead and app-compat testing), and enable kernel exploit mitigations - noting these reduce but do not eliminate the risk of a Win32k EoP.

CVE-2026-33824 CRITICAL POC
9.8 Apr 14

Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen

CVE-2026-56155 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p

CVE-2026-32202 MEDIUM POC
4.3 Apr 14

Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n

CVE-2026-49798 CRITICAL POC
9.3 Jul 14

Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve

CVE-2026-54128 HIGH POC
8.4 Jul 14

Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff

CVE-2026-50518 CRITICAL
9.8 Jul 14

Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr

CVE-2026-50655 HIGH POC
7.8 Jul 14

Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug

CVE-2026-54992 HIGH POC
7.8 Jul 14

Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component

CVE-2026-50489 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem

CVE-2026-50667 HIGH POC
7.0 Jul 14

Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c

CVE-2026-57092 CRITICAL
9.9 Jul 14

Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating

CVE-2026-56190 CRITICAL
9.8 Jul 14

Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary

Share

CVE-2026-56176 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy