CVE-2026-20814CWE-362

CVE-2026-20814

High · published January 13, 2026

CVSS v3.1
7.0
EPSS
0%
Percentile
20.8
In the wild
Unconfirmed
What it is

⚡ A sneaky race condition in the Graphics Kernel could allow authorized users to elevate their privileges locally – like a kitchen assistant suddenly becoming the head chef without anyone noticing! 🍽️ Imagine a busy restaurant where two chefs are trying to access the same set of ingredients at once, causing confusion and potentially leading to disastrous dishes. In this case, the Graphics Kernel is that kitchen, and the lack of proper synchronization is what leads to the mix-up. If an attacker successfully exploits this race condition, they could gain elevated privileges, bypassing normal restrictions. This means they could access sensitive areas of the system, alter configurations, or even take full control. It could be as serious as letting the wrong person run the show in a high-stakes environment!

Put simply

Imagine a busy restaurant where two chefs are trying to access the same set of ingredients at once, causing confusion and potentially leading to disastrous dishes. In this case, the Graphics Kernel is that kitchen, and the lack of proper synchronization is what leads to the mix-up. This vulnerability occurs due to improper synchronization in concurrent execution within the Graphics Kernel. An authorized user can exploit this flaw to elevate their privileges, granting them unauthorized access to restricted functionalities.

What to do

If an attacker successfully exploits this race condition, they could gain elevated privileges, bypassing normal restrictions. This means they could access sensitive areas of the system, alter configurations, or even take full control. It could be as serious as letting the wrong person run the show in a high-stakes environment! To remediate this vulnerability, ensure that your Graphics Kernel is updated to the latest version where this issue has been addressed. Monitor any access logs for unusual activity and enforce stricter privilege management policies. Don't wait—act fast! You've got this! With the right updates in place, you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00293 · 20.8th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-01-13T23:16Z
Affected products (14)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2016< 10.0.14393.878310.0.14393.8783
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:56Z
    DirectX Graphics Kernel Elevation of Privilege Vulnerability
    cvelistv5