Heap-based buffer overflow in Microsoft Windows and Windows Server - CVE-2026-105020

Vulnerability details

The vulnerability allows a local user to escalate privileges beyond an AppContainer's security boundary.

The vulnerability exists due to a heap-based buffer overflow in Windows Advanced Rasterization Platform when processing graphics data submitted to the isolated graphics compilation service. A local user can run a malicious application locally inside an AppContainer and submit specially crafted graphics data to perform actions within the affected service's isolated security context, outside the application's AppContainer.

Affected software

How to mitigate CVE-2026-105020

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-105020
• https://support.microsoft.com/help/5126651

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows