EUVD-2026-100046
GHSA-fhvq-2g3h-4fq4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
DeliveryExecute crafted program invoking Win32K GRFX
-
ExploitTrigger heap-based buffer overflow in kernel
-
ExecutionCorrupt adjacent kernel objects to hijack execution
-
ImpactElevate to SYSTEM privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess authenticated local access with at least low privileges on the target (PR:L) and the ability to execute code that reaches the Win32K GRFX kernel path; no user interaction is needed (UI:N) and it works against default configurations since Win32K is a built-in component present on all affected Windows editions. The key limiting factor is that the flaw is local-only (AV:L) - it cannot be triggered remotely across the network and therefore depends on a prior foothold on the machine; affected systems are those below the fixed build numbers listed in EUVD (e.g. Windows 11 24H2 below 10.0.26100.9711, Server 2022 below 10.0.20348.5761). |
| Impact | This is a genuine patch-priority issue despite not being a remote-exploitable flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation primitive: an attacker already on the host with low privileges and no user interaction can reliably (AC:L) corrupt the Win32K GRFX kernel heap (CWE-122) to achieve full C/I/A impact - i.e. SYSTEM-level code execution. Not in CISA KEV, so there is no confirmed active exploitation, and no public POC is indicated in the provided data; EPSS is not supplied. Win32K kernel LPE bugs are historically high-value second-stage components in exploit chains (post-phishing/post-RCE) and are frequently weaponized over time, so the absence of KEV/POC today reflects timing, not low intrinsic risk. The signals are internally consistent - no conflict between the vector and the 'elevate privileges locally' description. Net: treat as high priority for patching on any multi-user, kiosk, or internet-facing-workload Windows host even though it cannot be exploited remotely on its own. |
| Exploit ScenarioDerived | An attacker who has already gained a low-privileged foothold on a Windows machine (via phishing, a compromised service account, or a prior RCE) runs a crafted program that triggers the heap-based buffer overflow in the Win32K GRFX component. By grooming the kernel heap and corrupting adjacent structures, they elevate from the limited user context to SYSTEM, gaining full control of the host. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Heap-based buffer overflow in the Windows Win32K GRFX subsystem allows an authenticated local attacker holding only low privileges to escalate to kernel-level (SYSTEM) code execution, yielding full impact to confidentiality, integrity and availability (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw affects a wide range of unpatched Windows client and server builds - Windows 10 and Windows 11 through 26H2, plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and works against default configurations because Win32K is a built-in component present on every affected edition. No public exploit code exists and there is no confirmed active exploitation (not listed in CISA KEV); because the defect is local-only (AV:L) it cannot be triggered remotely and requires a prior foothold on the host, which makes this a patch-priority issue rather than a remotely weaponizable one.
RemediationAI
Vendor-released patch: Microsoft's fix is delivered through the standard Windows security update, and affected systems should be brought to at least the fixed builds listed by EUVD - Windows 10 1607 to 10.0.14393.9612, Windows 10 1809 and Server 2019 (including Server Core) to 10.0.17763.9376, Windows 10 21H2 and 22H2 to 10.0.19044.7807, Windows 11 23H2 to 10.0.22631.7652, Windows 11 24H2 to 10.0.26100.9711, Windows 11 25H2 to 10.0.26200.9711, Windows 11 26H1 to 10.0.28000.3231, Windows 11 26H2 to 10.0.26300.9711, Server 2025 (including Server Core) to 10.0.26100.33650, Server 2022 to 10.0.20348.5761, Server 2016 to 10.0.14393.9612, Server 2012 to 6.2.9200.26434 and Server 2012 R2 to 6.3.9600.23470; confirm exact package content against https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85908 before deployment. Because Win32K is a core, always-loaded component there is no supported way to disable or network-block the vulnerable code, so no port- or feature-level workaround can substitute for patching; compensating controls must instead shrink the local attack surface. Restrict interactive logon and RDP access to only trusted administrators (side effect: removes legitimate multi-user and remote-work scenarios), remove unnecessary local administrative or code-execution rights and enforce application control such as WDAC or AppLocker to prevent untrusted binaries from running in a user session (side effect: can break line-of-business software and requires an allow-list maintenance process), and segment or decommission unsupported builds such as Windows Server 2012/2012 R2. Monitor for exploit attempts by watching for repeated crashes or memory-corruption indicators in win32k.sys and for unexpected elevation from low-privileged processes, and prioritize patching on multi-user systems such as RDP hosts, VDI and terminal servers where an attacker foothold is most likely.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Win32K is the Windows kernel-mode driver that implements the graphics device interface (GDI), the window manager and the broader graphics/GRFX path, exposing a large set of NtGdi*/NtUser* system calls that any user-mode process, in any session, can reach. The root cause here is CWE-122, a heap-based buffer overflow: the kernel allocates a heap buffer for a graphics object or surface and then writes beyond it, typically because a size or bounds calculation on attacker-influenced parameters is wrong or a length check is missing at the user-to-kernel boundary. Win32K has historically been a favored privilege-escalation target precisely because it is always present and always reachable from low-privileged contexts, so a memory-safety failure there converts user-mode code execution into kernel-mode code execution. Consistent with the assessed vector (AV:L/AC:L/PR:L/UI:N/S:U), exploitation requires the attacker to already hold authenticated local access with at least low privileges (PR:L) and the ability to execute code that drives the Win32K GRFX path; no user interaction is needed (UI:N), scope is unchanged (S:U), and exploitation succeeds on default installations. The vulnerability is classified as Buffer Overflow / Heap Overflow under Microsoft's tagging, is tracked by ENISA as EUVD-2026-100046, and is attributed to secure@microsoft.com, with the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85908.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only kernel LPE requiring an existing low-privileged session (AV:L, PR:L), reliably triggerable with no user interaction (AC:L, UI:N), yielding SYSTEM-level full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity heap buffer overflow in the Win32K GRFX subsystem of Microsoft Windows lets anyone who already holds a low-privileged local account on a machine escalate to SYSTEM-level control of that host, affecting Windows 10 and Windows 11 through 26H2 plus Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core builds. Because Win32K ships by default in every affected edition, the exposure footprint covers effectively the entire Windows estate rather than a niche subset of systems. The defect is local-only and requires an existing foothold, so it is not remotely exploitable, but it remains a high-priority patch item: an attacker who lands on any unpatched endpoint or server could convert limited access into full administrative control of that system, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Exploit-DB