EUVD-2026-29595
GHSA-6v47-mj2x-w4rg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-priv access with no UI (AV:L/AC:L/PR:L/UI:N); a buffer over-read described as information disclosure justifies C:H but I:N/A:N, diverging from the vendor's I:H/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Buffer over-read in Windows DWM Core Library allows an authorized attacker to disclose information locally.
AnalysisAI
Local information disclosure in the Microsoft Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows 10, Windows 11 (through 26H1), and Windows Server (2016-2025) builds, where a buffer over-read (CWE-126) lets an already-authenticated local attacker read adjacent process memory. Microsoft's CVSS 7.8 vector rates full confidentiality, integrity, and availability impact even though the description characterizes the outcome as information disclosure, so the leaked memory could plausibly aid further local escalation. There is no public exploit identified at time of analysis, EPSS is negligible (0.04%), and CISA SSVC marks exploitation as none, but a vendor patch is available.
Technical ContextAI
The Desktop Window Manager (DWM) Core Library (dwmcore.dll) is the compositing engine that renders and manages the Windows graphical desktop; it runs as a system-level component that many user sessions interact with. CWE-126 (Buffer Over-read) means code reads past the intended bounds of a buffer, returning adjacent in-memory data that may contain sensitive contents such as pointers, tokens, or other process memory useful for defeating ASLR or staging privilege escalation. The affected CPE set spans Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2016 - indicating the flaw lives in shared DWM code common to the modern Windows codebase (build 10.0.x) rather than an edition-specific feature.
RemediationAI
Vendor-released patch: apply the Microsoft security update that raises each affected build to at or above its fixed version (for example, Windows 11 24H2 to 10.0.26100.8457, Windows 10 22H2 to 10.0.19045.7291, Server 2025 to 10.0.26100.32860, Server 2016/Server 2019 to 10.0.14393.9140/10.0.17763.8755) as listed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34336. Because exploitation requires local authenticated access, the primary compensating control until patching is to restrict and monitor interactive and RDP logon rights - limit who can run code on multi-user hosts, terminal servers, and jump boxes - since DWM is a core graphical component that cannot practically be disabled without breaking the desktop. Prioritize deployment on shared/RDS hosts where the population of low-privileged local users is largest; single-user, physically controlled workstations carry lower exposure. Cross-reference vuldb.com/vuln/363143 and the NVD entry for tracking.
More in Windows Server 2016
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today