CVE-2026-33104

HIGH

Win32k Elevation of Privilege Vulnerability

Title source: cna

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

References (1)

[Vendor Advisory] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33104

Scores

CVSS v3 7.0

EPSS 0.0004

EPSS Percentile 12.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-362 CWE-416

Status published

Products (37)

microsoft/windows_10_1607 < 10.0.14393.9060 (2 CPE variants)

microsoft/windows_10_1809 < 10.0.17763.8644 (2 CPE variants)

microsoft/windows_10_21h2 < 10.0.19044.7184 (3 CPE variants)

microsoft/windows_10_22h2 < 10.0.19045.7184 (3 CPE variants)

Microsoft/Windows 10 Version 1607 10.0.14393.0 - 10.0.14393.9060

Microsoft/Windows 10 Version 1809 10.0.17763.0 - 10.0.17763.8644

Microsoft/Windows 10 Version 21H2 10.0.19044.0 - 10.0.19044.7184

Microsoft/Windows 10 Version 22H2 10.0.19045.0 - 10.0.19045.7184

microsoft/windows_11_23h2 < 10.0.22631.6936 (2 CPE variants)

microsoft/windows_11_24h2 < 10.0.26100.8246 (2 CPE variants)

... and 27 more

Published Apr 14, 2026

Tracked Since Apr 14, 2026