EUVD-2026-29717
GHSA-xq6v-x2f5-r47x
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local EoP needing an existing low-privileged session (AV:L, PR:L), no interaction and low complexity, yielding SYSTEM control so full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where an integer overflow (CWE-190) lets an already-authenticated low-privileged user run code with SYSTEM-level rights. Microsoft has released a patch and reported the flaw itself; there is no public exploit identified at time of analysis, and the EPSS score is very low (0.06%). SSVC rates exploitation as none but technical impact as total, marking it a classic patch-Tuesday local EoP rather than a mass-exploitation threat.
Technical ContextAI
The Desktop Window Manager (DWM) is the compositing window manager that has powered the Windows graphical desktop since Windows Vista; its Core Library (dwmcore.dll) runs as a highly privileged system component responsible for rendering and composing on-screen surfaces. CWE-190 (Integer Overflow or Wraparound) means a size or offset calculation inside DWM wraps past its integer bounds, typically producing an undersized buffer allocation that is then written past - the input tags also flag this as leading to a Buffer Overflow. Because DWM runs at high integrity/SYSTEM, corrupting its memory from a lower-privileged context yields elevation. The affected CPEs are Microsoft Windows 11 versions 24H2, 25H2 and 26H1, plus Windows Server 2025 including the Server Core installation.
RemediationAI
Vendor-released patch: apply the Microsoft cumulative security update that raises the affected component to the fixed build for your OS - 10.0.26100.8457 or later for Windows 11 24H2, 10.0.26200.8457 for 25H2, 10.0.28000.2113 for 26H1, and 10.0.26100.32860 for Windows Server 2025 and its Server Core installation - as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42896. Because DWM is a core, non-optional component, there is no supported feature-disable workaround, so patching is the only real fix; until the update is deployed, reduce exposure by enforcing least-privilege so untrusted or standard users cannot run arbitrary local code (this is a local EoP requiring existing low-privilege access), restricting interactive and RDP logon rights on servers, and prioritizing patch deployment on shared/multi-user and Server Core hosts where low-privileged code execution is more likely. The trade-off of restricting interactive logon is reduced administrative convenience but it directly shrinks the population of attackers able to reach the vulnerable local vector.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today