What is the CVSS score of CVE-2026-44802?

CVE-2026-44802 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows DWM Core Library are affected by CVE-2026-44802?

Windows Desktop Window Manager (DWM) vulnerability CVE-2026-44802 allows standard user accounts to escalate privileges to system administrator level on any affected Windows computer, creating…. A patch is available.

How to fix or mitigate CVE-2026-44802?

Within 24 hours: Conduct inventory of Windows systems in the environment; disable or restrict non-essential user logons on critical business systems. Within 7 days: Deploy endpoint detection and response (EDR) tuning to flag DWM process anomalies and unexpected privilege escalation attempts; restrict interactive logon permissions for standard user accounts on administrative systems. Within 30 days: Monitor Microsoft security bulletins for CVE-2026-44802 patch release (specific version TBD by vendor); prepare automated patch deployment in enterprise patch management system upon release.

Windows DWM Core Library CVE-2026-44802

EUVD-2026-35753 HIGH

Use After Free (CWE-416)

2026-06-09 secure@microsoft.com

GHSA-9v4q-pmfw-6hgx

Denial Of Service Use After Free Memory Corruption Microsoft Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:48 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionCVE.org

Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated low-privilege attacker to gain higher privileges through a use-after-free memory corruption flaw. The vulnerability carries a CVSS score of 7.8 with high impact across confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Successful exploitation typically yields SYSTEM-level code execution on the affected Windows host.

Technical ContextAI

The Desktop Window Manager (DWM) is a core Windows graphics subsystem responsible for compositing the desktop, managing window rendering, and providing visual effects such as transparency and live thumbnails. The DWM Core Library runs with elevated privileges and handles object lifecycle for graphical resources shared between user-mode processes and the compositor. CWE-416 (Use After Free) indicates that a pointer to memory is dereferenced after the underlying object has been freed, allowing an attacker who can control the reallocated memory contents to corrupt program state, hijack control flow, or escalate privileges within the DWM process context.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44802 during the next Patch Tuesday cycle; patch status from the supplied data is best characterized as Patch available per vendor advisory, with specific KB numbers and build versions to be confirmed against the MSRC update guide for each affected Windows SKU. There is no practical workaround for a DWM Core Library flaw because DWM cannot be safely disabled on modern Windows without breaking the desktop shell, so compensating controls should focus on reducing local-attacker exposure: restrict interactive logon rights to trusted users via Group Policy, enforce application allowlisting (WDAC/AppLocker) to block unsigned local binaries, deploy EDR with kernel and graphics-subsystem telemetry to detect anomalous DWM child behavior, and prioritize patching on multi-user systems, RDS/Citrix hosts, and developer workstations where local code execution by lower-privileged accounts is most plausible.