Windows DWM Core CVE-2026-44804

Exploitation requires the attacker to already possess authenticated local access to the target Windows host with at least low-privilege (PR:L) execution capability - for example a standard user session, an RDP/Terminal Services logon, or code execution inside a sandboxed process such as a browser renderer. The Desktop Window Manager must be running, which is the default on all interactive Windows desktop and server installations with the Desktop Experience, so no non-default configuration is needed on the target. Limiting factors that constrain real-world risk: the AV:L attack vector rules out purely remote, network-only exploitation; the bug cannot be triggered from an unauthenticated network position and is not usable as an initial-access vector on its own, meaning it functions as a post-compromise privilege-escalation primitive that must be chained with a separate access vulnerability or credential theft.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) characterizes this as a high-severity local elevation-of-privilege issue requiring an authenticated foothold but no user interaction, with full triad impact within the same scope. There is no CISA KEV listing, no EPSS score provided, and no SSVC decision data supplied, so probabilistic exploitation signals are absent from the available intelligence. No public exploit identified at time of analysis, which tempers immediate mass-exploitation concern, but UAF bugs in DWM have a historical track record of being weaponized post-patch by reverse-engineering the fix - making this a meaningful priority for endpoints where initial-access malware or commodity loaders are a concern. Data gap to flag: the vuldb reference and MSRC advisory may carry additional exploitability or build-specific data not reflected here, and the affected Windows build list is not enumerated in the provided input.

An attacker who has already obtained low-privileged code execution on a Windows host - for example via a phishing payload, a browser sandbox escape, or stolen standard-user credentials over RDP - runs a local binary that interacts with the DWM Core Library to manipulate a graphics object such that DWM frees it while the attacker retains a reference. The attacker then reclaims the freed allocation with controlled data, triggers the dangling reference, and pivots execution into a higher-integrity context to install persistence or disable endpoint protections. No public exploit identified at time of analysis, but the attack requires no user interaction once the initial foothold exists.