Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local user account access
  2. Exploit
    Trigger use-after-free in DWM memory management
  3. Execution
    Corrupt heap metadata
  4. Impact
    Execute arbitrary code with SYSTEM privileges

Vulnerability Assessment

Weakness
CWE
CWE-416
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Local user account required on target system. Desktop Window Manager (DWM) must be running with specific memory state conditions. High attack complexity requires precise timing or repeated attempts to trigger vulnerability.
Impact

CVSS 7.0 (HIGH). Attack vector: Local. Complexity: High. Privileges required: Low. User interaction: None. Exploitable via local access.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to compromise the affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Use after free in Windows DWM allows an authorized attacker to elevate privileges locally. [CVSS 7.0 HIGH]

RemediationAI

Monitor vendor advisories for a patch.

Affected Packages

microsoft windows_10_version_21h2_10_0_19044_6809 fix: Windows 10 Version 21H2 for 32-bit Systems 10.0.19044.6809, Windows 10 Version 21H2 for ARM64-based Systems 10.0.19044.6809, Windows 10 Version 21H2 for x64-based Systems 10.0.19044.6809
microsoft windows_10_version_22h2_10_0_19045_6809 fix: Windows 10 Version 22H2 for 32-bit Systems 10.0.19045.6809, Windows 10 Version 22H2 for ARM64-based Systems 10.0.19045.6809, Windows 10 Version 22H2 for x64-based Systems 10.0.19045.6809
microsoft windows_11_version_23h2_10_0_22631_6491 fix: Windows 11 Version 23H2 for ARM64-based Systems 10.0.22631.6491, Windows 11 Version 23H2 for x64-based Systems 10.0.22631.6491
microsoft windows_11_version_24h2_10_0_26100_7623 fix: Windows 11 Version 24H2 for ARM64-based Systems 10.0.26100.7623, Windows 11 Version 24H2 for x64-based Systems 10.0.26100.7623
microsoft windows_11_version_25h2_10_0_26200_7623 fix: Windows 11 Version 25H2 for ARM64-based Systems 10.0.26200.7623, Windows 11 Version 25H2 for x64-based Systems 10.0.26200.7623
microsoft windows_server_2022_10_0_20348_4648 fix: Windows Server 2022 10.0.20348.4648, Windows Server 2022 (Server Core installation) 10.0.20348.4648
microsoft windows_server_2022_23h2_edition_10_0_25398_2092 fix: Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.2092
microsoft windows_server_2025_10_0_26100_32230 fix: Windows Server 2025 10.0.26100.32230, Windows Server 2025 (Server Core installation) 10.0.26100.32230

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 8 packages in microsoft

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-416 (Use After Free). Affects Windows 10 21H2. Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.

Know when Windows 10 21h2 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.

Executive ViewAI

Why It Matters

Organizations using Use after free in Windows DWM face moderate risk from CVE-2026-20842, a use-after-free vulnerability rated CVSS 7.0. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: Moderate
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Data Quality
3 sources
Confidence: Low
NVD CVE.org EPSS VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No

Priority Score

35
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +35
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*

More in Windows 10 21h2

View all
CVE-2021-34527 HIGH POC
8.8 Jul 02

<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
CVE-2022-30190 HIGH POC
7.8 Jun 01

Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
CVE-2023-36884 HIGH POC
7.5 Jul 11

Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
CVE-2024-21412 HIGH POC
8.1 Feb 13

Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2024-30088 HIGH POC
7.0 Jun 11

Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
CVE-2025-33053 HIGH POC
8.8 Jun 10

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
CVE-2025-33073 HIGH POC
8.8 Jun 10

Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
CVE-2024-21338 HIGH POC
7.8 Feb 13

Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
CVE-2013-3900 MEDIUM
5.5 Dec 11

Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update

CVE-2025-21293 HIGH POC
8.8 Jan 14

Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
CVE-2024-35250 HIGH POC
7.8 Jun 11

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8

References

Advisories & patches
ADVISORY https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20842 ADVISORY https://vuldb.com/vuln/340776

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy