CVE-2026-20822 Details
Description
Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
A use-after-free vulnerability has been identified in the Microsoft Graphics Component, allowing an authorized attacker to locally elevate privileges. This vulnerability requires exploitation of a race condition, and successful exploitation could lead to a scope change, allowing access to the host environment in a GPU paravirtualization scenario.
Users can download the security update for this vulnerability via the Microsoft Update Catalog. Security update KB5073722 is available for Windows Server 2016, Windows 10 Version 1607 (both x64 and 32-bit systems), Windows Server 2025, Windows 11 Version 24H2 (for both x64 and ARM64-based systems), Windows Server 2022 (Server Core installation), Windows 11 Version 23H2 (for both x64 and ARM64-based systems), Windows 11 Version 25H2 (for both x64 and ARM64-based systems), Windows Server 2022, Windows Server 2019 (both Server Core installation and regular version), and Windows 10 Version 1809 (for both x64 and 32-bit systems).
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20822 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| microsoft windows 10 1607 | < 10.0.14393.8783 |
CPE
Remediation
| |
| microsoft windows 10 1809 | < 10.0.17763.8276 |
CPE
Remediation
| |
| microsoft windows 10 21h2 | < 10.0.19044.6809 |
CPE
Remediation
| |
| microsoft windows 10 22h2 | < 10.0.19045.6809 |
CPE
Remediation
| |
| microsoft windows 11 23h2 | < 10.0.22631.6491 |
CPE
Remediation
| |
| microsoft windows 11 24h2 | < 10.0.26100.7623 |
CPE
Remediation
| |
| microsoft windows 11 25h2 | < 10.0.26200.7623 |
CPE
Remediation
| |
| microsoft windows server 2016 | < 10.0.14393.8783 |
CPE
Remediation
| |
| microsoft windows server 2019 | < 10.0.17763.8276 |
CPE
Remediation
| |
| microsoft windows server 2022 | < 10.0.20348.4648 |
CPE
Remediation
| |
| microsoft windows server 2022 23h2 | < 10.0.25398.2092 |
CPE
Remediation
| |
| microsoft windows server 2025 | < 10.0.26100.32230 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 14, 2026 | Initial Analysis | [email protected] |
| Jan 13, 2026 | New CVE Received | [email protected] |