CVE-2026-88073 is a high severity use after free flaw in Windows Graphics Kernel, scored 8.8. Microsoft ships the fix as a security update. Check your installed version against the affected list below, then patch or restrict access until you can. The record does not flag it as exploited.
What's affected
- Windows 10 21H2 and 22H2.
- Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2.
- Windows Server 2025.
Severity in the record: High (8.8), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Weakness: CWE-416.
Fix: Microsoft ships the fix as a security update. The exact KB numbers are in the MSRC advisory.
How to check if you're exposed
- Run
winverto see the build. - In PowerShell:
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10. - Compare against the MSRC update guide entry for your edition.
Run these on every affected device, including ones in remote sites, labs and spares that are powered on.
What to do now
- Confirm the version of every affected system using the checks above.
- Read the vendor advisory linked in Sources and note the fixed version for your release line.
- Schedule the update, starting with systems that face untrusted networks or hold the most sensitive data.
- In the meantime: prioritize multi-user systems such as terminal servers and shared workstations.
- Record the change, then recheck the version to confirm it took effect.
Why it matters
A use after free (CWE-416) in the Windows Graphics Kernel lets a local, authorized user raise their privileges. The scope is changed (S:C) in the vector, which is why the score is 8.8. The record's kev flag is false, so this post does not claim exploitation in the wild.
The record's KEV flag is false, so this post makes no claim that the flaw is exploited in the wild. That can change, so recheck the CISA catalog from time to time.
Network and management devices are patched less often than servers, because upgrades mean planned downtime. That gap is where a flaw like this stays open longest, so build the version check into your regular inventory.
The vector string in the record is a compact summary of how the flaw is reached and what it costs. AV is the attack vector (network, adjacent or local), PR is the privilege the attacker needs, and the C, I and A letters give the impact on confidentiality, integrity and availability. Read it against your own network layout rather than relying on the score alone.
After you patch
Patching is not the end of the job. Recheck the version on each system, because an upgrade that failed or rolled back looks the same as a success until someone looks. Keep the advisory link with your change record so the next reviewer can see why the update happened.
If you cannot patch soon, write down the reason, the compensating control you chose and a date to revisit. Exceptions without a date tend to become permanent.
Quick check
Does an attacker need to be logged in?
Yes, the record describes a local attacker with low privileges.
Sources
-
Microsoft: MSRC CVE-2026-88073
-
Safeguard Gold: CVE-2026-88073
Last reviewed: 18 October 2026.
