Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated attacker with no interaction (AV:L/PR:L/UI:N/AC:L); an OOB read most credibly yields info disclosure plus EoP-enabled integrity impact, so A:N unless corruption is confirmed.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Win32k GRFX subsystem across Windows 10, Windows 11, and Windows Server 2012 through 2025 lets an authenticated low-privileged local attacker elevate to SYSTEM by triggering an out-of-bounds read (CWE-125). The flaw was reported internally by Microsoft, a vendor patch is available via MSRC, and there is no public exploit identified at time of analysis. CVSS is 7.8 (High), reflecting a local vector with low complexity and low privileges required.
Technical ContextAI
Win32k is the Windows kernel-mode driver (win32k.sys / win32kfull.sys) implementing the GDI/graphics (GRFX) and windowing subsystem - historically one of the largest local kernel attack surfaces in Windows because it processes user-supplied graphics objects in ring 0. CWE-125 (Out-of-bounds Read) here indicates the GRFX component reads past the bounds of an allocated buffer while parsing or manipulating a graphics structure. Although an OOB read is classically an information-disclosure primitive, the affected CPEs span the full modern Windows kernel line (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2012 through 2025), consistent with a shared Win32k codepath; Microsoft's own tags label it both 'Information Disclosure' and 'Buffer Overflow'.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-56176 from the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56176), selecting the correct package for each affected SKU across Windows 10, Windows 11, and Windows Server 2012-2025 including Server Core; take the exact fixed build numbers from that advisory rather than assuming them. Because exploitation requires an existing local foothold, prioritize multi-user and shared systems (RDP/terminal session hosts, developer and jump boxes) where low-privileged accounts run untrusted code. Microsoft publishes no specific pre-patch workaround; as compensating controls, restrict interactive/local logon rights to trusted accounts (trade-off: may disrupt shared-access workflows), enforce application allowlisting to limit attacker code execution (trade-off: management overhead and app-compat testing), and enable kernel exploit mitigations - noting these reduce but do not eliminate the risk of a Win32k EoP.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-44238
GHSA-73hr-7mmq-82g4