Windows DWM Core CVE-2026-42905

The attacker must already possess valid low-privileged local code execution on the target Windows host (CVSS PR:L, AV:L) - the bug cannot be triggered remotely over the network and requires the ability to invoke the affected DWM Core Library code path locally. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once an attacker has any authenticated session - interactive console, RDP, terminal services, or even a sandboxed user-mode process that can reach the DWM IPC surface - exploitation is straightforward. Limiting factors are therefore the requirement for prior foothold and a logged-on session in which DWM is running (i.e., a graphical desktop session, not a Server Core install without the Desktop Experience).

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a local attack vector with low complexity, low privileges required, and no user interaction - a profile typical of post-compromise privilege escalation chains rather than initial access. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV at the time of this analysis, and EPSS data is not provided in the input. SSVC framing is not provided, but historically DWM use-after-free EoPs (e.g., CVE-2023-36033, CVE-2024-30051) have been weaponized rapidly post-disclosure by ransomware affiliates and APTs, so defenders should treat this as a high-priority patch despite the absence of public PoC. A key data gap: no fix-version string or specific Windows build was supplied in the input - verify the patched KB through MSRC before relying on auto-update.

An attacker who has already gained low-privileged code execution on a Windows host - for example via a phishing payload or a compromised standard-user account - runs a local exploit that triggers and then races the freed DWM object, sprays the heap with a controlled replacement, and gains code execution in a higher-integrity context. This is the classic second-stage of a malware chain, turning a foothold into SYSTEM-level control suitable for credential theft, defense evasion, and lateral movement. No public PoC has been observed at the time of this analysis.