CVE-2026-85908

Cve • October 14, 2026

Share: View original

Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

CWE-122 : Heap-based Buffer Overflow

CWE-190 : Integer Overflow or Wraparound

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

Default Status: unknown

msrc.microsoft.com: Windows Graphics Component Elevation of Privilege Vulnerability external site vendor-advisory patch

Authorized Data Publishers

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Elevation of Privilege Vulnerabilities in Windows Disclosed On October 13, 2026, four elevation of privilege vulnerabilities were disclosed in Windows components, including CVE-2026-85908, CVE-2026-83785, CVE-2026-96858, and CVE-2026-83886. These vulnerabilities allow authorized attackers to elevate privileges locally through various attack vectors such as heap-based buffer overflow and use after free. The affected components include Windows Win32K, COM+ Event System Service, and Windows Security Account Manager. The CVEs have been assigned CVSS scores ranging from 5.5 to 7.8, indicating high severity. As of now, the status of these vulnerabilities remains unknown, and no patches have been confirmed to be released. Security professionals are advised to monitor for updates and apply patches as they become available. 4 sources 59

Extracted Entities

Attack Types (1)

Privilege Escalation

CVEs (1)

CWE Weaknesses (2)

CWE-122 - Heap-based Buffer Overflow CWE-190 - Integer Overflow Or Wraparound

MITRE ATT&CK (1)

T1068 - Exploitation for Privilege Escalation

Platforms (1)