CVE-2026-118229

HighCVSS 8.8/10Last modified Nov 10, 2026

Description

Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Microsoft	Windows 10 Version 1809	>= 10.0.17763.0, < 10.0.17763.9376
Microsoft	Windows 10 Version 21H2	>= 10.0.19044.0, < 10.0.19044.7807
Microsoft	Windows 10 Version 22H2	>= 10.0.19045.0, < 10.0.19045.7807
Microsoft	Windows 11 version 23H2	>= 10.0.22631.0, < 10.0.22631.7652
Microsoft	Windows 11 Version 23H2	>= 10.0.22631.0, < 10.0.22631.7652
Microsoft	Windows 11 Version 24H2	>= 10.0.26100.0, < 10.0.26100.9711
Microsoft	Windows 11 Version 25H2	>= 10.0.26200.0, < 10.0.26200.9711
Microsoft	Windows 11 version 26H1	>= 10.0.28000.0, < 10.0.28000.3231
Microsoft	Windows 11 Version 26H2	>= 10.0.26300.0, < 10.0.26300.9711
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.9376
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.17763.0, < 10.0.17763.9376
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.5761
Microsoft	Windows Server 2025	>= 10.0.26100.0, < 10.0.26100.33650
Microsoft	Windows Server 2025 (Server Core installation)	>= 10.0.26100.0, < 10.0.26100.33650

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118229

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-118237.5The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the b CVE-2026-1182328.8Out-of-bounds read in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1182359.8The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File U CVE-2026-1182375.3An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a hos CVE-2026-1182387.2The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validat CVE-2026-1182395.6The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowe CVE-2026-118247.8SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cau CVE-2026-1182412.7The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, only checking a CVE-2026-1182428.5Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from renderin CVE-2026-1182435.3Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and st CVE-2026-1182447.2Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw mar CVE-2026-1182458.6Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unche