Windows DirectX Graphics Kernel Vulnerability Could Allow Privilege Escalation (CVE-2026-50375)

A security vulnerability in Microsoft Windows could allow a local attacker to elevate their privileges and potentially execute code with Windows kernel-level permissions.

The vulnerability, tracked as CVE-2026-50375, affects the Windows DirectX Graphics Kernel and was addressed by Microsoft in its July 2026 security updates. The flaw has been rated as a high-severity vulnerability by several security organisations, although Microsoft’s own CVSS assessment rates it as medium severity.

What is CVE-2026-50375?

CVE-2026-50375 is a vulnerability affecting the Windows DirectX Graphics Kernel, specifically the `dxgkrnl.sys` component responsible for supporting graphics functionality within Windows.

According to vulnerability information associated with the flaw, the problem involves memory corruption in the DirectX Graphics Kernel. The vulnerability has been described as a heap-based buffer overflow, while security research from Trend Micro’s Zero Day Initiative describes the underlying issue as a time-of-check/time-of-use problem involving inadequate locking of an object.

An attacker who is already able to execute code locally with low-level privileges could potentially exploit the vulnerability to obtain higher privileges.

This is particularly significant because successful exploitation could allow an attacker to move from a restricted user account to the Windows kernel, giving them considerably greater control over the affected system.

How serious is the vulnerability?

The vulnerability has received different CVSS assessments.

Microsoft rates CVE-2026-50375 at 6.3, classifying it as a medium-severity vulnerability. Its scoring reflects the fact that exploitation requires local access and existing privileges, with relatively high attack complexity.

Other vulnerability databases have assigned the flaw a CVSS score of 7.8, placing it in the high-severity category. This higher score assumes a lower level of attack complexity and gives the vulnerability high potential impacts on confidentiality, integrity and availability.

The difference highlights an important point about CVSS scoring: the underlying vulnerability is the same, but different assessments can place different weights on the conditions required for exploitation.

What could an attacker do?

CVE-2026-50375 is a local privilege escalation vulnerability.

An attacker would first need the ability to execute code on the target Windows computer. The vulnerability does not, by itself, provide a remote attacker with an initial way into a machine.

Once code execution has been obtained, however, exploitation of the DirectX Graphics Kernel vulnerability could potentially allow the attacker to elevate their privileges.

Successful exploitation could result in code executing with kernel-level privileges.

The Windows kernel operates at one of the highest privilege levels in the operating system. Gaining control at this level could allow an attacker to interfere with security controls, access protected resources, modify system components or carry out other malicious activity.

The Zero Day Initiative states that exploitation can allow a local attacker to execute arbitrary code in the context of the Windows kernel.

Which versions of Windows are affected?

Microsoft’s affected products include a wide range of supported Windows desktop and server releases.

Affected versions include:

* Windows 10 version 1809
* Windows 10 version 21H2
* Windows 10 version 22H2
* Windows 11 version 24H2
* Windows 11 version 25H2
* Windows 11 version 26H1
* Windows Server 2019
* Windows Server 2022
* Windows Server 2025
* Windows Server 2019 Server Core
* Windows Server 2025 Server Core

The vulnerability therefore affects both workstation and server environments.

Microsoft releases security updates

Microsoft addressed CVE-2026-50375 through its July 2026 security updates.

Security updates were made available for the affected Windows versions, including cumulative updates for Windows 10, Windows 11 and Windows Server.

Security information compiled by Rapid7 lists the relevant July 2026 cumulative updates, including KB5099538, KB5099539, KB5099540, KB5099536 and KB5101650, depending on the Windows version.

Organisations should therefore ensure that their Windows systems have received the appropriate July 2026 cumulative update or a later security update.

Is CVE-2026-50375 being exploited?

At the time of the available vulnerability assessments, CVE-2026-50375 was not listed in the CISA Known Exploited Vulnerabilities catalogue.

Rapid7’s vulnerability database also reported that the vulnerability was not in the CISA KEV catalogue.

However, the absence of confirmed exploitation does not mean the vulnerability should be ignored.

Privilege escalation vulnerabilities are particularly useful to attackers who have already gained an initial foothold on a system. A criminal could potentially combine an initial compromise with a local privilege escalation vulnerability to obtain greater control over the machine.

Why DirectX vulnerabilities matter

DirectX is normally associated with gaming, graphics and multimedia applications, but its components form part of the Windows operating system and operate with significant privileges.

A vulnerability in a graphics kernel component can therefore have consequences that extend beyond an individual application.

Attackers frequently look for privilege escalation vulnerabilities after obtaining an initial foothold. Moving from a standard or restricted account to SYSTEM or kernel-level privileges can make it much easier to disable security software, access protected files, establish persistence and move further through a network.

What should Windows users do?

The primary recommendation is to install the latest available Microsoft security updates.

Home users should make sure Windows Update is enabled and that their computer has installed the latest cumulative update.

Businesses should identify affected Windows systems across their environments and verify that the relevant July 2026 security updates, or subsequent cumulative updates, have been installed.

Administrators should also monitor systems for suspicious activity involving unexpected privilege escalation, unusual processes and attempts to interact with Windows kernel components.

Conclusion

CVE-2026-50375 is a Windows DirectX Graphics Kernel vulnerability that could allow a local attacker with existing access to elevate privileges and potentially execute arbitrary code with kernel-level permissions.

While Microsoft rates the vulnerability at 6.3, other assessments have placed it at 7.8 high severity. The vulnerability affects a broad range of Windows desktop and server products, making patching particularly important for organisations managing large Windows estates.

There is currently no indication that CVE-2026-50375 has been added to the CISA Known Exploited Vulnerabilities catalogue, but privilege escalation flaws remain valuable to attackers who have already compromised a system.

Windows users and administrators should therefore ensure that the appropriate Microsoft security updates are installed and that affected systems are not left unpatched.