CVE-2026-96144: Windows Graphics Kernel Information Disclosure Vulnerability

CVE-2026-96144 is an information disclosure vulnerability in Windows Graphics Kernel, rated Important by Microsoft, with a CVSS 3.1 base score of 4.7 (Medium). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.32% probability of exploitation activity in the next 30 days, higher than 25% of all scored vulnerabilities. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday, delivered through 10 security updates (KB5131291, KB5131085, KB5131096, KB5131090 and more). It affects 29 products in 3 product families (ESU, Windows, Microsoft Office).

Key facts

CVE ID: CVE-2026-96144
Severity: Medium CVSS 4.7
Microsoft severity: Important
Impact: Information Disclosure
Exploited in the wild: No
Publicly disclosed: No
Exploitation likelihood: Less Likely
Weakness: CWE-908
EPSS: 0.32% (percentile 25%)
CISA KEV: Not listed
Released: 10 November 2026
Last updated: 13 November 2026
Patch Tuesday: November 2026 Patch Tuesday
Product families: ESU, Windows, Microsoft Office

CVSS score and vector

Microsoft scores CVE-2026-96144 at 4.7 (temporal 4.1) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Metric	Value
Attack vector	Local
Attack complexity	High
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	None
Availability impact	None
Exploit code maturity	Unproven
Remediation level	Official fix
Report confidence	Confirmed

Description

Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.

Frequently asked questions (Microsoft)

What type of information could be disclosed by this vulnerability?

An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to win a race condition.

Affected products (29)

ESU

Product	Security update	Type	Fixed build	Restart
Windows 10 Version 1607 for 32-bit Systems	KB5131291	Security Update	10.0.14393.9688	Yes
Windows 10 Version 1607 for x64-based Systems	KB5131291	Security Update	10.0.14393.9688	Yes
Windows Server 2016	KB5131291	Security Update	10.0.14393.9688	Yes
Windows Server 2016 (Server Core installation)	KB5131291	Security Update	10.0.14393.9688	Yes
Windows 10 Version 22H2 for 32-bit Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for x64-based Systems

Windows

Product	Security update	Type	Fixed build	Restart
Windows 10 Version 1809 for 32-bit Systems	KB5131085	Security Update	10.0.17763.9487	Yes
Windows 10 Version 1809 for x64-based Systems	KB5131085	Security Update	10.0.17763.9487	Yes
Windows Server 2019	KB5131085	Security Update	10.0.17763.9487	Yes
Windows Server 2019 (Server Core installation)	KB5131085	Security Update	10.0.17763.9487	Yes
Windows 10 Version 21H2 for 32-bit Systems	KB5131096	Security Update	10.0.19044.7846	Yes
Windows 10 Version 21H2 for ARM64-based Systems	KB5131096	Security Update	10.0.19044.7846	Yes
Windows 10 Version 21H2 for x64-based Systems	KB5131096	Security Update	10.0.19044.7846	Yes
Windows Server 2022	KB5131090	Security Update	10.0.20348.5870	Yes
Windows Server 2022 (Server Core installation)	KB5131090	Security Update	10.0.20348.5870	Yes
Windows 11 Version 23H2 for ARM64-based Systems	KB5131087	Security Update	10.0.22631.7711	Yes
Windows 11 Version 23H2 for x64-based Systems	KB5131087	Security Update	10.0.22631.7711	Yes
Windows 11 Version 24H2 for ARM64-based Systems	KB5132061 KB5132043	Security Update Security Update	10.0.26100.9974 10.0.26100.9911	Yes No
Windows 11 Version 24H2 for x64-based Systems	KB5132061 KB5132043	Security Update Security Update	10.0.26100.9974 10.0.26100.9911	Yes No
Windows 11 Version 25H2 for ARM64-based Systems	KB5132043	Security Update	10.0.26200.9911	No
Windows 11 Version 25H2 for x64-based Systems	KB5132043	Security Update	10.0.26200.9911	No
Windows 11 Version 26H2 for ARM64-based Systems	KB5132043	Security Update	10.0.26300.9911	No
Windows 11 Version 26H2 for x64-based Systems	KB5132043	Security Update	10.0.26300.9911	No
Windows Server 2025	KB5131080 KB5131077	Security Update Security Update	10.0.26100.33822 10.0.26100.33730	Yes No
Windows Server 2025 (Server Core installation)	KB5131080 KB5131077	Security Update Security Update	10.0.26100.33822 10.0.26100.33730	Yes No
Windows 11 Version 26H1 for ARM64-based Systems	KB5132059	Security Update	10.0.28000.3501	Yes
Windows 11 version 26H1 for x64-based Systems	KB5132059	Security Update	10.0.28000.3501	Yes

Microsoft Office

Product	Security update	Type	Fixed build	Restart
Microsoft Office for Android	Release Notes	Security Update	16.0.20625.20014

Security updates (10)

KB5131291 (Security Update)
KB5131085 (Security Update)
KB5131096 (Security Update)
KB5131090 (Security Update)
KB5131087 (Security Update)
KB5132061 (Security Update)
KB5132043 (Security Update)
KB5131080 (Security Update)
KB5131077 (Security Update)
KB5132059 (Security Update)

NIST NVD data

NVD status: Awaiting Analysis
NVD CVSS: 4.7 (MEDIUM)
NVD weakness: CWE-908
Published to NVD: 10 November 2026
NVD last modified: 11 November 2026

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96144

Acknowledgments

byzero, mj with Kunlun Lab & Zhiniang Peng with HUST

Revision history

Version	Date	Description
1.0	10 November 2026	Information published.
1.1	13 November 2026	Added Microsoft Office software to the Security Updates table. Customers that are running supported version of Microsoft Office are encouraged to update to the indicated version to be protected from this vulnerability.