Windows Graphics Kernel CVE-2026-96118

The attacker must already have the ability to run code locally as an authenticated low-privileged user on the affected Windows system (AV:L, PR:L) - there is no remote or network vector and no path for unauthenticated access. No special product feature or non-default configuration is named in the description; the vulnerable Graphics Kernel component is present by default on all affected editions (Windows 10/11 client builds and Windows Server 2012 through 2025, including Server Core). The primary limiting factor is the required pre-existing local foothold; exploitation is constrained to unpatched builds below the fixed versions listed in the EUVD data (e.g. Windows 11 24H2 below 10.0.26100.9711, Server 2022 below 10.0.20348.5761).

This is a locally-exploitable elevation-of-privilege flaw in the Windows Graphics Kernel (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The CVSS vector is internally consistent and credible: AV:L confirms the attacker must already have local code-execution ability, PR:L confirms low-privileged but authenticated access is required, and AC:L with UI:N means exploitation is reliable and needs no victim interaction. No EPSS score, KEV listing, or POC indicator is present in the supplied data, so there is no current signal of active exploitation or public exploit code - this reads as a standard patch-cycle EoP rather than an urgent in-the-wild threat. The main caveat is that the root weakness is an out-of-bounds READ (CWE-125), which typically yields information disclosure, yet Microsoft rates C:H/I:H/A:H (full confidentiality, integrity, and availability impact); this is normal for kernel EoP where leaked kernel memory is chained into full SYSTEM compromise, but the leap from 'read primitive' to I:H/A:H depends on exploit chaining and should be verified against the Microsoft advisory. Priority is moderate: patch in the normal monthly cadence, but prioritize multi-user, RDS/VDI, and shared-host systems where untrusted users already have a local foothold.

A low-privileged but authenticated user (or malware already running in a standard user context) on a Windows host triggers the out-of-bounds read in the Graphics Kernel to leak kernel memory, then leverages that to corrupt kernel state and elevate to SYSTEM. No user interaction is required. No public exploit code is identified at time of analysis, so this would require a locally-executed, attacker-developed exploit.