High · 7.0 Exploitation more likely CVE-2026-23668 EUVD-2026-10588GHSA-vhp7-43g5-88q3

Windows Graphics Component Elevation of Privilege Vulnerability

Published Mar 10, 2026 · Updated Jun 19, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Windows 10 Version 1607 Product: Windows 10 Version 1809 Product: Windows 10 Version 21H2 Product: Windows 10 Version 22H2 Product: Windows 11 version 22H3 Product: Windows 11 version 23H2 Product: Windows Server 2012 Product: Windows Server 2012 (Server Core installation) Product: Windows Server 2012 R2 Product: Windows Server 2012 R2 (Server Core installation) Product: Windows Server 2016 Product: Windows Server 2016 (Server Core installation) Product: Windows Server 2019 Product: Windows Server 2019 (Server Core installation) Product: Windows Server 2022 Product: Windows Server 2022, 23H2 Edition (Server Core installation) Platform: Windows

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Windows 10 Version 1607	10.0.14393.0 – < 10.0.14393.8957	10.0.14393.8957
Microsoft	Windows 10 Version 1809	10.0.17763.0 – < 10.0.17763.8511	10.0.17763.8511
Microsoft	Windows 10 Version 21H2	10.0.19044.0 – < 10.0.19044.7058	10.0.19044.7058
Microsoft	Windows 10 Version 22H2	10.0.19045.0 – < 10.0.19045.7058	10.0.19045.7058
Microsoft	Windows 11 version 22H3	10.0.22631.0 – < 10.0.22631.6783	10.0.22631.6783
Microsoft	Windows 11 Version 23H2	10.0.22631.0 – < 10.0.22631.6783	10.0.22631.6783
Microsoft	Windows Server 2012	6.2.9200.0 – < 6.2.9200.25973	6.2.9200.25973
Microsoft	Windows Server 2012 (Server Core installation)	6.2.9200.0 – < 6.2.9200.25973	6.2.9200.25973
Microsoft	Windows Server 2012 R2	6.3.9600.0 – < 6.3.9600.23074	6.3.9600.23074
Microsoft	Windows Server 2012 R2 (Server Core installation)	6.3.9600.0 – < 6.3.9600.23074	6.3.9600.23074
Microsoft	Windows Server 2016	10.0.14393.0 – < 10.0.14393.8957	10.0.14393.8957
Microsoft	Windows Server 2016 (Server Core installation)	10.0.14393.0 – < 10.0.14393.8957	10.0.14393.8957
Microsoft	Windows Server 2019	10.0.17763.0 – < 10.0.17763.8511	10.0.17763.8511
Microsoft	Windows Server 2019 (Server Core installation)	10.0.17763.0 – < 10.0.17763.8511	10.0.17763.8511
Microsoft	Windows Server 2022	10.0.20348.0 – < 10.0.20348.4893	10.0.20348.4893
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	10.0.25398.0 – < 10.0.25398.2207	10.0.25398.2207

Advisories 3

WID-SEC-2026-0661 Microsoft Windows und Windows Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 5, 2026
NCSC-2026-0080 Kwetsbaarheden verholpen in Microsoft Windows NCSC-NL (Netherlands) · Mar 10, 2026
MSRC-CVE-2026-23668 Windows Graphics Component Elevation of Privilege Vulnerability Microsoft Security Response Center · Mar 10, 2026

References

Windows Graphics Component Elevation of Privilege Vulnerability vendor-advisory patch