EUVD-2026-22542Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
AnalysisAI
Desktop Window Manager (DWM) privilege escalation via use-after-free memory corruption affects Windows 10 21H2/22H2, Windows 11 22H3 through 25H2, and Windows Server 2022/2025. Local authenticated attackers with low privileges can exploit this memory corruption flaw to gain SYSTEM-level access, achieving full compromise of confidentiality, integrity, and availability. Vendor-released patches are available across all affected platforms. No public exploit identified at time of analysis, though the
Technical ContextAI
Desktop Window Manager (dwm.exe) is a core Windows compositing engine responsible for rendering the visual desktop experience, window animations, and Aero glass effects. This vulnerability stems from CWE-416 (Use After Free), a memory safety flaw where freed heap memory is subsequently accessed. In DWM's case, this likely occurs during window object lifecycle management or graphics buffer handling. The use-after-free condition allows an authenticated local attacker to manipulate freed memory contents before reallocation, potentially hijacking control flow or injecting malicious code. Since DWM runs with SYSTEM privileges to perform its compositing functions, successful exploitation grants attackers full kernel-level access. The CPE data indicates widespread impact across modern Windows client and server platforms (Windows 10 build 19044/19045, Windows 11 build 22631/26100/26200, Windows Server 2022 build 20348/25398, Windows Server 2025 build 26100), suggesting a shared code path in the DWM implementation across these versions.
RemediationAI
Apply Microsoft's security updates immediately through Windows Update or WSUS infrastructure. Patched versions are Windows 10 21H2 build 10.0.19044.7184 or later, Windows 10 22H2 build 10.0.19045.7184 or later, Windows 11 22H3/23H2 build 10.0.22631.6936 or later, Windows 11 24H2 build 10.0.26100.32690 or later, Windows 11 25H2 build 10.0.26200.8246 or later, Windows Server 2022 build 10.0.20348.5020 or later, Windows Server 2022 23H2 Edition build 10.0.25398.2274 or later, and Windows Server 2025 build 10.0.26100.32690 or later. No workarounds are documented. Organizations unable to patch immediately should enforce strict least-privilege policies, monitor for abnormal dwm.exe process behavior, and implement application allowlisting to prevent unauthorized local code execution. Detailed patch deployment guidance and security update packages are available through the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32155.
More in Windows Server 2022
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today