EUVD-2026-35747
GHSA-mr6m-hrrm-6262
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local execution
-
DeliveryInvoke crafted DWM graphics calls
-
ExploitTrigger use-after-free in DWM Core
-
ExecutionReclaim freed object with controlled data
-
PersistHijack execution in DWM context
-
ImpactElevate to SYSTEM privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Attacker must already have authenticated local code execution as a low-privileged user on the target Windows host (CVSS PR:L, AV:L) - the bug is not reachable across the network and cannot be triggered without an existing foothold. No user interaction is required (UI:N), and attack complexity is low (AC:L), so once local code execution is achieved, exploitation is reliable against any Windows build shipping the unpatched DWM Core Library. The attack is limited to systems where DWM is running (effectively all modern interactive Windows desktops and servers with the Desktop Experience installed); headless server installations without DWM loaded are not exposed via this vector. |
| Impact | The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a local, low-complexity attack requiring only low privileges and no user interaction, with high impact across confidentiality, integrity, and availability - a classic privilege-escalation profile rather than a remote-exploitation risk. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied, so widespread opportunistic exploitation is unlikely in the immediate term; however, DWM UAF bugs have historically been chained into local EoP components of broader attack toolkits (browser sandbox escapes, post-compromise privilege uplift), so defenders should still treat it as a priority patch on multi-user and endpoint systems. The CWE-20 classification in NVD conflicts mildly with the description's 'use after free' wording - both are plausible (the validation flaw enabling the UAF), but the precise trigger should be verified against Microsoft's advisory before assuming a specific exploitation primitive. |
| Exploit ScenarioDerived | An attacker who has already obtained low-privileged code execution on a Windows host - for example via a phishing payload running as a standard user or a compromised service account - invokes a crafted sequence of graphics/window-management calls that interact with DWM Core Library, triggering the use-after-free and reclaiming the freed allocation with attacker-controlled data. Successful exploitation yields code execution in the higher-privileged DWM context, which is then used to escalate to SYSTEM and disable endpoint defenses or pivot laterally. No public exploit identified at time of analysis, but DWM UAFs have a strong track record of being weaponized for local EoP. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library allows an authenticated low-privileged user to elevate to higher privileges on the host by triggering a use-after-free condition. The flaw was reported by Microsoft (MSRC) and carries a CVSS 7.8 with no public exploit identified at time of analysis. EPSS data was not provided and the issue is not currently listed in CISA KEV.
RemediationAI
Apply the Microsoft security update referenced in the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44811) on the next patch cycle; the exact fix build numbers were not included in the provided data and should be read directly from the advisory's 'Security Updates' table for each affected Windows SKU. No vendor-supplied workaround was published in the available references, so compensating controls are limited to standard local-EoP hardening: restrict interactive logon and remote desktop access to trusted accounts (reduces who can reach the local attack surface), enforce Credential Guard and LSA protection to limit downstream value of a successful EoP, and ensure EDR rules are tuned to flag anomalous child processes spawning from dwm.exe (may produce noise on systems running graphical automation tools). Disabling DWM is not a viable mitigation on modern Windows because it is required for the composited desktop.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Desktop Window Manager (DWM) is the compositing window manager responsible for rendering the Windows desktop, including visual effects, transparency, and per-window buffers. Its Core Library runs with elevated privileges in user-mode and brokers requests from less-privileged graphical clients, making memory-safety defects in this surface a long-standing path to local privilege escalation. The advisory points to a use-after-free (typically CWE-416), where an object is referenced after being freed, allowing an attacker to control the contents at the freed allocation and ultimately influence execution flow within the DWM context; NVD has classified the underlying root cause more broadly as CWE-20 (Improper Input Validation), suggesting the freed-object access is reachable via crafted input from a lower-privileged caller.
Know when Windows 11 26h1 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A local privilege escalation vulnerability in Windows Desktop Window Manager Core Library (CVE-2026-44811) allows authenticated standard users to elevate to system-level privileges on affected systems. With no patch currently available from Microsoft, organizations must implement defensive controls to limit exposure across all Windows infrastructure. This affects every Windows-based organization where standard users have local system access.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce principle of least privilege-restrict standard user accounts from local logon rights on critical systems; (2) Implement privileged access management (PAM) solutions to limit local administrative access; (3) Deploy AppLocker policies to restrict execution and limit DWM process abuse vectors; (4) Enable Windows security logging and configure alerting for privilege escalation and unusual process elevation attempts; (5) Isolate or air-gap systems where DWM privilege escalation poses unacceptable operational risk; (6) Monitor for unexpected DWM process termination, memory corruption errors, or system crashes as potential exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Windows DWM Core Library Use-After-Free EoP
View all 8More in Windows 11 26h1
View allCommand injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Remote code execution in Microsoft Windows HTTP.sys allows unauthenticated network attackers to execute arbitrary code b
Privilege elevation in the Windows TCP/IP networking stack allows an unauthenticated attacker on an adjacent network to
Remote code execution in Windows RRAS affects Windows 10 1607 and Windows Server 2022 23h2 through an integer overflow v
Local code execution in Microsoft Windows Win32K GRFX (graphics) subsystem allows an attacker with low-privilege local a
Local code execution in the Windows Win32K GRFX (graphics) subsystem allows an unauthorized attacker with the ability to
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an
Local privilege escalation in Windows Push Notifications enables an authenticated low-privileged user to elevate to high
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) in conc
Exploit-DB