Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Microsoft Windows 10 (versions 1809, 21H2 and 22H2), Windows 11 (versions 23H2, 24H2, 25H2 and 26H1), and Windows Server 2019 are affected by a stack-based buffer overflow in the Win32K component. An authorized attacker with network access can exploit it to elevate privileges. Upgrade to the fixed builds listed for your version: 10.0.17763.9245 or later for 1809 and Server 2019, 10.0.19044.7725 or later for 21H2, 10.0.19045.7725 or later for 22H2, 10.0.22631.7582 or later for 23H2, 10.0.26100.9445 or later for 24H2, 10.0.26200.9445 or later for 25H2, and 10.0.28000.2954 or later for 26H1.
Not analysed yet
We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 8.0 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C | CNA (microsoft) |
- CISA KEV Not listed.
- EPSS 0.0077, the 55th percentile, on 11 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 8 Sept 2026, 17:12 UTC Confirmed by the CVE List
- 31 Oct 2026, 16:20 UTC First seen by agentprime