Race Condition in Graphics Kernel Enables Local Privilege Escalation

Publication date: 2026-01-13

Last updated on: 2026-01-13

Assigner: Microsoft Corporation

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-13

Last Modified

2026-01-13

Generated

2026-07-06

AI Q&A

2026-01-14

EPSS Evaluated

2026-07-05

NVD

CVE-2026-20836

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	graphics_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition in the Graphics Kernel caused by concurrent execution using a shared resource without proper synchronization. It allows an authorized attacker to elevate their privileges locally. [1]

Impact Analysis

The vulnerability can allow an authorized attacker to elevate their privileges on the affected system, potentially gaining higher-level access than intended, which can lead to unauthorized actions or control. [1]

Hi! I’m here to help you understand CVE-2026-20836. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70