Windows DWM Core CVE-2026-42983

Attacker must already have local code execution as a low-privileged authenticated user on the target Windows system (CVSS PR:L), with no user interaction required (UI:N) and no special non-default configuration needed - DWM Core is a built-in component running by default on all supported Windows installations with a graphical session. Exploitation is limited to scenarios where the attacker can run arbitrary code locally and cannot be performed over the network, which excludes pure remote attackers but is fully applicable to RDP/VDI/Terminal Services users, standard domain users on shared workstations, and post-exploitation chains following initial access. A logon session capable of interacting with DWM (interactive or remote desktop session) is required; service or sandboxed contexts with no window-manager access may not be able to reach the vulnerable code path.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a low-complexity local attack requiring some prior access (PR:L) with no user interaction and high impact across the CIA triad - characteristic of a reliable local EoP primitive. The vulnerability is not listed in CISA KEV, and no EPSS score or public POC was supplied in the intelligence set, suggesting it is not currently part of mass-exploitation campaigns. However, DWM use-after-free issues have historically been weaponized post-disclosure by commodity malware and ransomware affiliates as a SYSTEM-escalation step after initial foothold, so it should be prioritized for patching on multi-user, RDP, and VDI hosts despite the absence of in-the-wild reports. Notably, the supplied tags include 'Denial Of Service' alongside use-after-free and memory corruption - the CVSS reflects the EoP impact, but DoS as a degraded outcome is plausible if exploitation is unreliable.

An attacker who has already obtained low-privileged code execution on a Windows host - for example via a phishing payload, a browser exploit, or a stolen standard-user credential - runs a local tool that repeatedly triggers the vulnerable DWM Core code path, grooms the heap to reclaim the freed object, and uses the dangling pointer to corrupt a privileged structure and escalate to SYSTEM. From SYSTEM the attacker disables EDR, dumps LSASS for credentials, and moves laterally. No public exploit identified at time of analysis, but the CVSS AC:L rating suggests a reliable exploit is feasible once the bug pattern is understood.