EUVD-2026-35566
GHSA-g34g-39q4-7286
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft Windows Desktop Window Manager (DWM) Core Library enables an authorized low-privileged user to gain elevated privileges through a use-after-free memory corruption flaw. The vulnerability carries a CVSS 3.1 score of 7.8 with high impact on confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Exploitation requires the attacker to already have local code execution as a standard user, making it a strong candidate for post-compromise chaining toward SYSTEM-level access.
Technical ContextAI
The Desktop Window Manager (DWM) is the compositing window manager in modern Windows operating systems that handles rendering and visual effects, running with elevated privileges to manage GUI composition for all sessions. The DWM Core Library is a core component implicated here, and the underlying flaw is classified as CWE-416 (Use After Free), in which memory is referenced after it has been released back to the allocator. In such conditions, an attacker who can influence the contents of the freed memory region (for example by spraying controlled objects in its place) can hijack object pointers, virtual function tables, or other control structures, ultimately redirecting execution flow inside a process running at higher privilege than the attacker.
RemediationAI
Apply the security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45637 (Patch available per vendor advisory; exact KB and fixed build numbers are listed there per affected Windows SKU). Until patches are deployed, reduce exposure by restricting interactive and remote-desktop logon rights to trusted users, applying the principle of least privilege so that fewer accounts can reach the local prerequisite for exploitation, and ensuring EDR is tuned to detect anomalous child processes or token manipulation originating from dwm.exe; note that disabling DWM is not a viable workaround on supported Windows versions because the modern desktop composition pipeline depends on it and turning it off will break the user-facing GUI.
More in Windows 10 1809
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows contains an elevation of privilege vulnerability known as 'HiveNightmare' or 'SeriousSAM' where overly permissiv
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today