Exposure of Sensitive System Information to an Unauthorized Control Sphere in Microsoft Windows and Windows Server - CVE-2026-96137
Published: November 11, 2026
Vulnerability identifier: #VU165751
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-96137
CWE-ID: CWE-497
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive system information by reading small portions of heap memory.
The vulnerability exists due to exposure of sensitive system information to an unauthorized control sphere in Windows Graphics Kernel when handling local access. A local user can access exposed heap memory contents to obtain sensitive system information.
Affected software
Microsoft Windows
Windows Server
Windows Server
How to mitigate CVE-2026-96137
Install security update from vendor's website.
Microsoft Windows - addressed in versions 11 24H2 10.0.26100.9911, 11 24H2 10.0.26100.9974, 11 25H2 10.0.26200.9911, 11 25H2 10.0.26200.9974, 11 26H1 10.0.28000.3501
Windows Server - addressed in versions 2025 10.0.26100.33730, 2025 10.0.26100.33822
Windows Server - addressed in versions 2025 10.0.26100.33730, 2025 10.0.26100.33822