What is the CVSS score of CVE-2026-56176?

CVE-2026-56176 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows Win32k are affected by CVE-2026-56176?

A privilege escalation vulnerability in Windows 10, 11, and Server 2012-2025 allows authenticated local users to elevate to SYSTEM access, creating risk across the enterprise Windows infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-56176?

Within 24 hours, inventory all Windows systems to identify instances of Windows 10, 11, and Server 2012 through 2025 and determine exposure scope. Within 7 days, obtain the MSRC patch, validate it in a test environment, and initiate phased deployment starting with high-criticality systems. Within 30 days, complete patch deployment across all affected Windows systems and confirm installation through patch management system reporting.

Windows Win32k CVE-2026-56176

EUVD-2026-44238 HIGH

Out-of-bounds Read (CWE-125)

2026-07-14 microsoft

GHSA-73hr-7mmq-82g4

Buffer Overflow Information Disclosure Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Local authenticated attacker with no interaction (AV:L/PR:L/UI:N/AC:L); an OOB read most credibly yields info disclosure plus EoP-enabled integrity impact, so A:N unless corruption is confirmed.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:10 vuln.today

CVE Published

Jul 14, 2026 - 17:09 nvd

HIGH 7.8

DescriptionCVE.org

Out-of-bounds read in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Win32k GRFX subsystem across Windows 10, Windows 11, and Windows Server 2012 through 2025 lets an authenticated low-privileged local attacker elevate to SYSTEM by triggering an out-of-bounds read (CWE-125). The flaw was reported internally by Microsoft, a vendor patch is available via MSRC, and there is no public exploit identified at time of analysis. CVSS is 7.8 (High), reflecting a local vector with low complexity and low privileges required.

Technical ContextAI

Win32k is the Windows kernel-mode driver (win32k.sys / win32kfull.sys) implementing the GDI/graphics (GRFX) and windowing subsystem - historically one of the largest local kernel attack surfaces in Windows because it processes user-supplied graphics objects in ring 0. CWE-125 (Out-of-bounds Read) here indicates the GRFX component reads past the bounds of an allocated buffer while parsing or manipulating a graphics structure. Although an OOB read is classically an information-disclosure primitive, the affected CPEs span the full modern Windows kernel line (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2012 through 2025), consistent with a shared Win32k codepath; Microsoft's own tags label it both 'Information Disclosure' and 'Buffer Overflow'.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-56176 from the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56176), selecting the correct package for each affected SKU across Windows 10, Windows 11, and Windows Server 2012-2025 including Server Core; take the exact fixed build numbers from that advisory rather than assuming them. Because exploitation requires an existing local foothold, prioritize multi-user and shared systems (RDP/terminal session hosts, developer and jump boxes) where low-privileged accounts run untrusted code. Microsoft publishes no specific pre-patch workaround; as compensating controls, restrict interactive/local logon rights to trusted accounts (trade-off: may disrupt shared-access workflows), enforce application allowlisting to limit attacker code execution (trade-off: management overhead and app-compat testing), and enable kernel exploit mitigations - noting these reduce but do not eliminate the risk of a Win32k EoP.