Windows DWM Core Library CVE-2026-45637

The attacker must already have local code execution on the target Windows host as an authorized, low-privileged user (CVSS PR:L), meaning a valid interactive or remote session and the ability to run an arbitrary binary or script - purely remote, unauthenticated exploitation is not in scope. No user interaction by another principal is required (UI:N), and attack complexity is low (AC:L), so once local access exists the trigger is reliable, but exploitation is limited to hosts running an unpatched Windows version that includes the vulnerable DWM Core Library; kiosks, locked-down workstations, or servers that prevent unprivileged users from executing code are correspondingly out of reach.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a locally exploitable issue with low attack complexity, low privileges required, no user interaction, and unchanged scope, yielding a base score of 7.8 and full CIA impact - consistent with a privilege escalation that yields SYSTEM or equivalent on a Windows host. No EPSS score, KEV listing, or SSVC decision data was supplied with this record, so probability of mass exploitation and active-exploitation status cannot be quantified from the inputs. No public exploit identified at time of analysis, but Windows DWM use-after-free bugs have historically been weaponized by sophisticated actors as second-stage LPE primitives once initial access is obtained, so this should be treated as a credible post-exploitation risk on any unpatched endpoint rather than dismissed as a low-real-risk high-CVSS finding; key data missing is EPSS and KEV, which should be re-checked after Microsoft's advisory is fully published.

An attacker who has already obtained a foothold as a standard domain user - for example via a phishing-delivered loader or a browser exploit - runs a local tool that triggers the use-after-free in the DWM Core Library, sprays the heap to reclaim the freed object, and pivots control flow to execute code in a higher-privileged context. The result is elevation to SYSTEM on the compromised endpoint, enabling credential theft, disabling of security tooling, and lateral movement; no public exploit identified at time of analysis, but the bug class is well-understood and proof-of-concept development is feasible for capable researchers.