Systems
CVE-2026-118219
Local privilege escalation via use-after-free in Windows Advanced Rasterization Platform
Major vulnerability. Windows OS component (WARP) affects a broad enterprise footprint; local privilege escalation to SYSTEM can enable full compromise and warrants org-wide attention.
- CVSS
- 8.8Highscored by the publisher (CNA)
- Exploited in the wild
- Not knownnot in CISA KEV as of our last sync
- EPSS
- 0.34%chance of exploitation in the next 30 daystop 73% of scored CVEsFIRST score of 11 Nov 2026
- Fix
- Patch availablesee the advisories in the references
- Published
- 10 Nov 2026analysed here 12 Nov 2026
Summary
Impact
Local attacker can elevate privileges to SYSTEM by exploiting a use-after-free in Windows Advanced Rasterization Platform (WARP).
The summary, impact and action text on this page are written by our AI analysis pipeline, or taken from the NVD description when a CVE was imported from NVD. They are not the vendor's wording: check them against the sources. A longer AI executive summary and technical analysis are generated for signed-in accounts on the Max plan.
Affected products
| Product | Affected versions | Vendor says fixed in |
|---|---|---|
| Microsoft Windows 10 Version 1809 | >= 10.0.17763.0 and < 10.0.17763.9376Vendor says fixed in: not stated | |
| Microsoft Windows 10 Version 21H2 | >= 10.0.19044.0 and < 10.0.19044.7807Vendor says fixed in: not stated | |
| Microsoft Windows 10 Version 22H2 | >= 10.0.19045.0 and < 10.0.19045.7807Vendor says fixed in: not stated | |
| Microsoft Windows 11 version 23H2 | >= 10.0.22631.0 and < 10.0.22631.7652Vendor says fixed in: not stated | |
| Microsoft Windows 11 Version 23H2 | >= 10.0.22631.0 and < 10.0.22631.7652Vendor says fixed in: not stated | |
| Microsoft Windows 11 Version 24H2 | >= 10.0.26100.0 and < 10.0.26100.9711Vendor says fixed in: not stated | |
| Microsoft Windows 11 Version 25H2 | >= 10.0.26200.0 and < 10.0.26200.9711Vendor says fixed in: not stated | |
| Microsoft Windows 11 version 26H1 | >= 10.0.28000.0 and < 10.0.28000.3231Vendor says fixed in: not stated | |
| Microsoft Windows 11 Version 26H2 | >= 10.0.26300.0 and < 10.0.26300.9711Vendor says fixed in: not stated | |
| Microsoft Windows Server 2019 | >= 10.0.17763.0 and < 10.0.17763.9376Vendor says fixed in: not stated | |
| Microsoft Windows Server 2019 (Server Core installation) | >= 10.0.17763.0 and < 10.0.17763.9376Vendor says fixed in: not stated | |
| Microsoft Windows Server 2022 | >= 10.0.20348.0 and < 10.0.20348.5761Vendor says fixed in: not stated | |
| Microsoft Windows Server 2025 | >= 10.0.26100.0 and < 10.0.26100.33650Vendor says fixed in: not stated | |
| Microsoft Windows Server 2025 (Server Core installation) | >= 10.0.26100.0 and < 10.0.26100.33650Vendor says fixed in: not stated |
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.
Products named in our analysis
- Windows 10
- Windows 11
- Windows Server (WARP component)
- See MSRC advisory
Fix and mitigation
Action required
Patch when possible
Remediation steps (AI-written)
Step-by-step remediation is generated for accounts on the Max plan, for CVEs that match a technology in their stack. Add this technology to your stack to see the fix checklist.
Exploitation evidence
- CISA KEV catalog
- Not listed as of our last sync.
- Public exploit code
- None on record in Exploit-DB, Metasploit, Nuclei templates or PoC-in-GitHub.
- CISA SSVC
- exploitation none, automatable no, technical impact totalAssessed by CISA 10 Nov 2026 (SSVC 2.0.3). Exploitation is none, poc (public proof of concept) or active.
Timeline
- 10 Nov 2026Published
- 10 Nov 2026CISA SSVC assessment: exploitation nonesame day later
- 11 Nov 2026CVE record last updated1 day later
- 12 Nov 2026Analysed by vulneraibility.com1 day later
Common questions
Is CVE-2026-118219 being exploited?
Not confirmed. CVE-2026-118219 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 0.34% probability of exploitation in the next 30 days.
How severe is CVE-2026-118219?
CVE-2026-118219 is rated High with a CVSS score of 8.8. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-118219?
Yes. A fix has been recorded for CVE-2026-118219. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-118219 affect?
CVE-2026-118219 affects Windows 10, Windows 11, Windows Server (WARP component), See MSRC advisory. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-118219?
Install Microsoft security update per MSRC advisory and restrict local account access until patched.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
References
1 reference in the CVE record, grouped by the tags the record gives them.
Patches (1)
- msrc.microsoft.com /update-guide/vulnerability/CVE-2026-118219
Where the data on this page comes from
- CVE List (CVE.org): description, affected versions, references; CVE Terms of Use
- NVD: CVSS and CPE data
- CISA Vulnrichment (ADP): SSVC decision points
- FIRST EPSS: exploit probability and percentile
Summary, impact and triage tags: written by our AI analysis pipeline from the sources above. Check them against the sources.
Similar CVEs
Get CVEs like this by email. Join the free digest: the CVEs we flag as major, all CVSS 8.0 or higher, in up to three emails a day (sent at 05:00, 11:00 and 15:00 UTC). Matching alerts to the products you run needs an account, and accounts are invite-only during the beta.