What happened
CVE-2026-105023 is a heap-based buffer overflow in the Windows Advanced Rasterization Platform. An authorised attacker with local access and a low-privileged account can exploit the flaw to elevate privileges; no user interaction is required. The reported severity is high, with a CVSS score of 8.8. The weakness is classified as CWE-122. NVD analysis is still in progress, so the scope may change.
Who is affected
The verified affected versions are:
Windows 10 Version 1809, 32-bit and x64: <code>10.0.17763.0</code> to before <code>10.0.17763.9376</code>. Windows 10 Version 21H2, 32-bit, ARM64 and x64: <code>10.0.19044.0</code> to before <code>10.0.19044.7807</code>. Windows 10 Version 22H2, 32-bit, ARM64 and x64: <code>10.0.19045.0</code> to before <code>10.0.19045.7807</code>. Windows 11 Version 23H2, ARM64 and x64: <code>10.0.22631.0</code> to before <code>10.0.22631.7652</code>. Windows 11 Version 24H2, ARM64 and x64: <code>10.0.26100.0</code> to before <code>10.0.26100.9711</code>.
A fix is available. The supplied information does not identify fixed version numbers; the vendor advisory should be checked for applicable fixed releases.
Recommended actions
- Apply the available fix to affected deployments, checking the vendor advisory for the applicable fixed release.
- Restrict and review local account access, including the assignment of privileges to low-privileged accounts.
- Enforce device-access controls to limit who can obtain local access to affected hosts.
- Monitor endpoints for unexpected privilege changes and other suspicious activity consistent with local privilege escalation.
